From 74e0286032b42709e2a9df2fb86f199144fb5065 Mon Sep 17 00:00:00 2001
From: Benjamin Sparks <b.sparks@alugha.com>
Date: Mon, 23 Mar 2026 13:15:42 +0100
Subject: [PATCH] python3Packages.nltk: patch CVE-2025-33231 and CVE-2026-33236

CVE-2026-33231: unauthenticated remote shutdown
https://nvd.nist.gov/vuln/detail/CVE-2026-33231

CVE-2026-33236: arbitrary file overwrite
https://nvd.nist.gov/vuln/detail/CVE-2026-33236
---
 .../python-modules/nltk/default.nix           | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/pkgs/development/python-modules/nltk/default.nix b/pkgs/development/python-modules/nltk/default.nix
index 6a1fa040f7a6..129b09cd84ff 100644
--- a/pkgs/development/python-modules/nltk/default.nix
+++ b/pkgs/development/python-modules/nltk/default.nix
@@ -2,6 +2,7 @@
   lib,
   pkgs,
   fetchPypi,
+  fetchpatch,
   buildPythonPackage,
   click,
   joblib,
@@ -29,6 +30,24 @@ buildPythonPackage rec {
     hash = "sha256-D0CemwacpBd8GQPD6EPu+Qx+kpkvpJMa5gfabeSeFBk=";
   };
 
+  patches = [
+    # https://github.com/nltk/nltk/security/advisories/GHSA-jm6w-m3j8-898g
+    # https://github.com/NixOS/nixpkgs/issues/502599
+    (fetchpatch {
+      name = "fix-unauthed-shutdown";
+      url = "https://github.com/nltk/nltk/commit/bbaae83db86a0f49e00f5b0db44a7254c268de9b.patch";
+      hash = "sha256-1ZzOQXiNxZ6o7JQs0b9FpsUjZtuUAjXEmDkc9mV3dYU=";
+    })
+
+    # https://github.com/nltk/nltk/security/advisories/GHSA-469j-vmhf-r6v7
+    # https://github.com/NixOS/nixpkgs/issues/502535
+    (fetchpatch {
+      name = "fix-downloader-path-traversal";
+      url = "https://github.com/nltk/nltk/commit/89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a.patch";
+      hash = "sha256-hQJmVEDDcio4Ew+Y10WzMV53mpYZuuDsFcEZKEzl7nk=";
+    })
+  ];
+
   dependencies = [
     click
     joblib