annotald (>=1.3.1, <=1.3.7) potentially affected by CVE-2026-63312 via nltk (2.0.4)

nltk PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on nltk and may be impacted: - annotald =1.3.1, =1.3.7 Source cves: CVE-2026-63312 Source advisory: OSV:GHSA-X5PH-MJ9P-RFR8...

CVE-2026-63312

creationtimestamp| type| source ---|---|--- 2026-08-22 21:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtp67lynrr2r 2026-08-24 12:11:36+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117150416497083462 2026-09-08 16:35:10+00:00|...

DEBIAN-CVE-2026-63312

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...

annotald (>=1.3.1, <=1.3.7) potentially affected by CVE-2026-63312 via nltk (2.0.4)

nltk PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on nltk and may be impacted: - annotald =1.3.1, =1.3.7 Source cves: CVE-2026-63312 Source advisory: OSV:PYSEC-2026-3730...

annotald (1.3.8), caterpillar (>=1.0.0.dev4, <=1.0.0.dev17) potentially affected by CVE-2026-63312 via nltk (2.0.5)

nltk PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on nltk and may be impacted: - annotald 1.3.8 - caterpillar =1.0.0.dev4, =1.0.0.dev17 Source cves: CVE-2026-63312 Source advisory: OSV:PYSEC-2026-3730...