CVE-2026-63310 [HIGH] – NLTK before 3.9.3 fails to verify file integrity after downloading packages and before ext

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation.