CVE-2026-12252

Affected versions of the `nltk` package are vulnerable to Code Injection due to executing user-controllable JAR files without integrity verification. The Stanford interface classes `StanfordPOSTagger`, `StanfordNERTagger`, `StanfordParser`, `StanfordDependencyParser` and `StanfordNeuralDependencyParser` accept a JAR path and run it through the `java()` function, which calls `subprocess.Popen()` without the SHA256 verification already added to `StanfordSegmenter` for CVE-2026-0848. An attacker who can influence the JAR path an application loads, or substitute the JAR file, can execute arbitrary code with the privileges of the process using these classes.