diff --git a/.github/workflows/vulnerability-scan.yml b/.github/workflows/vulnerability-scan.yml
index 0feeb04a56..8311a269ec 100644
--- a/.github/workflows/vulnerability-scan.yml
+++ b/.github/workflows/vulnerability-scan.yml
@@ -100,6 +100,13 @@ jobs:
             # GHSA-xph7-9rjv-w5fr (CVE-2026-45831): SimpleRBACAuthorizationProvider
             # ignores tenant/database/collection scope.
             --ignore-vuln GHSA-xph7-9rjv-w5fr
+            # nltk <=3.10.3: GHSA-8mgp-746c-j5xp (CVE-2026-81726): model-artifact
+            # APIs bypass pathsec and read/write outside allowed roots. No patched
+            # PyPI release yet (fixes are on nltk develop only). Transitive via
+            # crewai-tools[xml] -> unstructured; CrewAI does not call those APIs.
+            # TODO: drop this ignore when bumping nltk past 3.10.3 to a patched
+            # release; keep the ignore list in sync with .pre-commit-config.yaml.
+            --ignore-vuln GHSA-8mgp-746c-j5xp
           )
           uv run pip-audit "${pip_audit_args[@]}"
         continue-on-error: true
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 8a005564bf..1c9c187ac9 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -29,6 +29,7 @@ repos:
       - id: pip-audit
         name: pip-audit
         # Keep this ignore list in sync with .github/workflows/vulnerability-scan.yml.
+        # TODO: drop --ignore-vuln GHSA-8mgp-746c-j5xp when bumping nltk past 3.10.3.
         entry: >-
           bash -c 'source .venv/bin/activate && uv run pip-audit --skip-editable
           --ignore-vuln PYSEC-2024-277
@@ -59,7 +60,8 @@ repos:
           --ignore-vuln GHSA-f4j7-r4q5-qw2c
           --ignore-vuln GHSA-2wm9-hf6c-p5cr
           --ignore-vuln GHSA-36p7-vc44-83pf
-          --ignore-vuln GHSA-xph7-9rjv-w5fr' --
+          --ignore-vuln GHSA-xph7-9rjv-w5fr
+          --ignore-vuln GHSA-8mgp-746c-j5xp' --
         language: system
         pass_filenames: false
         stages: [pre-push, manual]
diff --git a/lib/crewai-tools/pyproject.toml b/lib/crewai-tools/pyproject.toml
index 908bd5cf06..ab17af65b5 100644
--- a/lib/crewai-tools/pyproject.toml
+++ b/lib/crewai-tools/pyproject.toml
@@ -123,8 +123,10 @@ xml = [
     "unstructured[local-inference, all-docs]>=0.17.2",
     # unstructured allows nltk>=3.9.2, but <3.10.3 still has PYSEC-2026-3726
     # (symlink file read in IPIPANCorpusReader; 3.10.0-3.10.1) plus later
-    # 3.10.2 findings. Declared here, not only as a uv override, so consumers
-    # installing crewai-tools[xml] get the fixed version.
+    # 3.10.2 findings. 3.10.3 still has unpatched GHSA-8mgp-746c-j5xp
+    # (ignored in pip-audit until a release ships). TODO: drop that ignore
+    # when bumping nltk past 3.10.3. Declared here, not only as a uv
+    # override, so consumers installing crewai-tools[xml] get this floor.
     "nltk>=3.10.3",
 ]
 oxylabs = [
diff --git a/pyproject.toml b/pyproject.toml
index d3e8a4f6a9..52b4b876c2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -226,7 +226,11 @@ exclude-newer-package = { msgpack = "2026-06-20T00:00:00Z", pydantic-settings =
 # 3.9.4, so that ignore is no longer needed. 3.10.0-3.10.1 have PYSEC-2026-3726
 # (symlink-based arbitrary file read in IPIPANCorpusReader); fixed in 3.10.2.
 # 3.10.3 also clears later 3.10.2 findings (proxy SSRF, pickle allowlist RCE,
-# JVM option injection, XML entity expansion). Transitive via
+# JVM option injection, XML entity expansion). 3.10.3 still has
+# GHSA-8mgp-746c-j5xp (CVE-2026-81726; model-artifact pathsec bypass); no
+# patched PyPI release yet, so that GHSA is ignored in pip-audit until one
+# ships. TODO: drop --ignore-vuln GHSA-8mgp-746c-j5xp when bumping nltk
+# past 3.10.3. Transitive via
 # crewai-tools[xml] -> unstructured.
 # pydantic-settings <2.14.2 has GHSA-4xgf-cpjx-pc3j.
 # h2 <=4.4.0 has GHSA-6hr6-w5qg-qmwg (CVE-2026-71554): duplicate Host headers