6 matches found
NLTK: Corpus Reader Sandbox Bypass
Summary NLTK corpus-reader constructors can still reach outside-root file and database reads before the nltk.pathsec sandbox boundary is enforced. The PoC shows the safe path blocked by pathsec.open, then LinThesaurusCorpusReader and PanLexLiteCorpusReader succeeding in the same process. Affected...
GHSA-3GQ4-3J92-5W49 NLTK: Corpus Reader Sandbox Bypass
Summary NLTK corpus-reader constructors can still reach outside-root file and database reads before the nltk.pathsec sandbox boundary is enforced. The PoC shows the safe path blocked by pathsec.open, then LinThesaurusCorpusReader and PanLexLiteCorpusReader succeeding in the same process. Affected...
Duplicate Advisory: NLTK: Corpus Reader Sandbox Bypass
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3gq4-3j92-5w49. This link is maintained to preserve external references. Original Description NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows...
GHSA-RCW8-9QRW-27M2 Duplicate Advisory: NLTK: Corpus Reader Sandbox Bypass
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3gq4-3j92-5w49. This link is maintained to preserve external references. Original Description NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows...
CVE-2026-79674 NLTK 3.10.2 Path Traversal via corpus-reader constructors
NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access...
CVE-2026-79674: External Control of File Name or Path
NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access...