EUVD-2026-64338

NLTK: Symlink-based sandbox bypass in FramenetCorpusReader bypasses the fix for CVE-2026-54292...

GHSA-F833-7JW8-XWRV NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

This is a new, distinct vulnerability: a bypass of the fix already published as GHSA-xh95-f55m-82fw "Path traversal in NLTK FramenetCorpusReader.frame allows arbitrary XML file read, bypassing the nltk.pathsec sandbox", not a duplicate of it. Summary The original advisory was fixed PR 3581 by...

NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

This is a new, distinct vulnerability: a bypass of the fix already published as GHSA-xh95-f55m-82fw "Path traversal in NLTK FramenetCorpusReader.frame allows arbitrary XML file read, bypassing the nltk.pathsec sandbox", not a duplicate of it. Summary The original advisory was fixed PR 3581 by...

EUVD-2026-64337

NLTK: Stable FrameNet and NKJP readers parse outside-root XML...

GHSA-568F-PV23-39P4 NLTK: Stable FrameNet and NKJP readers parse outside-root XML

Summary Published nltk==3.9.4 still contains several XML-reader entrypoints that build parser paths from caller-controlled selectors or trusted-looking index state without preserving the corpus-root boundary. Details - Vulnerability type: Path traversal and trusted-root bypass - Affected componen...

NLTK: Stable FrameNet and NKJP readers parse outside-root XML

Summary Published nltk==3.9.4 still contains several XML-reader entrypoints that build parser paths from caller-controlled selectors or trusted-looking index state without preserving the corpus-root boundary. Details - Vulnerability type: Path traversal and trusted-root bypass - Affected componen...

CVE-2026-70626

creationtimestamp| type| source ---|---|--- 2026-09-08 16:35:14+00:00| published-proof-of-concept| https://github.com/nltk/nltk/security/advisories/GHSA-r6gq-whwq-mvg9...

NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction. The download flow at lines 789-825: 1. File is downloaded to a temp path via HTTP 2. os.replacetmpfilepath, filepath moves it to the final location line 799 3. Extraction begins vi...

GHSA-5WP5-5229-5G6Q NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction. The download flow at lines 789-825: 1. File is downloaded to a temp path via HTTP 2. os.replacetmpfilepath, filepath moves it to the final location line 799 3. Extraction begins vi...

EUVD-2026-64333

NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read...

NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read

Summary Setting nltk.pathsec.ENFORCE = True is documented to sandbox all file access to allowed NLTK data directories and raise PermissionError on unauthorized access. However, StreamBackedCorpusView opens files via builtins.open directly, bypassing pathsec.validatepath entirely. An attacker who...

GHSA-X5PH-MJ9P-RFR8 NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read

Summary Setting nltk.pathsec.ENFORCE = True is documented to sandbox all file access to allowed NLTK data directories and raise PermissionError on unauthorized access. However, StreamBackedCorpusView opens files via builtins.open directly, bypassing pathsec.validatepath entirely. An attacker who...

NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol

Summary There's a logic bug in FileSystemPathPointer.open inside nltk/data.py that makes the sandbox check permanently inert. The guard condition is always False — meaning any file the process can read is accessible by passing a file:// URL to nltk.data.load. --- Details In nltk/data.py,...

EUVD-2026-64309

NLTK: FileSystemPathPointer.open sandbox check is dead code — arbitrary file read via file:// protocol...

GHSA-72R2-7MFR-5XR9 NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol

Summary There's a logic bug in FileSystemPathPointer.open inside nltk/data.py that makes the sandbox check permanently inert. The guard condition is always False — meaning any file the process can read is accessible by passing a file:// URL to nltk.data.load. --- Details In nltk/data.py,...

EUVD-2026-64314

NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root...

NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root

Summary nltk.corpus.reader.api.CorpusReader.open can be used to read files outside the intended corpus root via a symlink placed inside that root. Although NLTK blocks absolute paths and .. traversal, the current boundary check is only lexical and does not account for symlink resolution. This lea...

GHSA-R6GQ-WHWQ-MVG9 NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root

Summary nltk.corpus.reader.api.CorpusReader.open can be used to read files outside the intended corpus root via a symlink placed inside that root. Although NLTK blocks absolute paths and .. traversal, the current boundary check is only lexical and does not account for symlink resolution. This lea...

The vulnerability of the java() function in the nltk/internals.py file of the NLTK library, a software package for symbolic and statistical processing of natural language, allows a hacker to gain control over the system.

The vulnerability of the java function in the nltk/internals.py file of the NLTK library, a software package for symbolic and statistical processing of natural language, is related to the implementation or modification of arguments. Exploiting this vulnerability could allow an attacker to gain...

SUSE CVE-2026-78682

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen and callers nltk.data.load, nltk.downloader.Downloader.index/download when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables...