CVE-2026-71514

NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader._load_lang_ngrams . The function joins the corpus root with a value read from the corpus table.txt mapping file and opens the result using the builtin open() instead of the pathsec -validated opener. Because...

EUVD-2026-64295

NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. loadlangngrams joins the corpus root with crubadancode, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open rather than the pathsec-validated opener, s...