CVE-2026-33231: Unauthenticated remote shutdown in nltk.app.wordnet_app

March 19, 2026 (updated April 25, 2026)

nltk.app.wordnet_app allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple GET /SHUTDOWN%20THE%20SERVER request causes the process to terminate immediately via os._exit(0), resulting in a denial of service.

References

github.com/advisories/GHSA-jm6w-m3j8-898g
github.com/nltk/nltk/commit/bbaae83db86a0f49e00f5b0db44a7254c268de9b
github.com/nltk/nltk/security/advisories/GHSA-jm6w-m3j8-898g
nvd.nist.gov/vuln/detail/CVE-2026-33231

Code Behaviors & Features

Detect and mitigate CVE-2026-33231 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →