Remote code execution via unchecked ZIP extraction

Path traversal in the NLTK downloader before 3.9.3 allows remote attackers to execute code through a crafted data package. The _unzip_iter function passes archive members to zipfile.extractall() without checking for absolute paths, parent-directory traversal, drive letters, or symlink escapes, allowing writes outside the extraction root. Exploitation requires the downloader to retrieve and extract an attacker-controlled package; resulting writes inherit the Python process privileges, and planted Python files execute when imported.