GHSA-FG9W-WFP5-J933 NLTK: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read

Summary BllipParser in nltk/parse/bllip.py hands caller-supplied filesystem paths to the native bllipparser C extension without routing them through NLTK's pathsec validation. The constructor parameters parsermodel, rerankerfeatures, and rerankerweights, and the alternative fromunifiedmodeldir...

NLTK: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read

Summary BllipParser in nltk/parse/bllip.py hands caller-supplied filesystem paths to the native bllipparser C extension without routing them through NLTK's pathsec validation. The constructor parameters parsermodel, rerankerfeatures, and rerankerweights, and the alternative fromunifiedmodeldir...

Duplicate Advisory: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fg9w-wfp5-j933. This link is maintained to preserve external references. Original Description NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to...

CVE-2026-126295

NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parsermodel, rerankerfeatures, rerankerweights, or fromunifiedmodeldir input can make...

CVE-2026-126295 NLTK 3.10.0 before 3.10.4 Arbitrary File Read via BllipParser Model Paths

NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parsermodel, rerankerfeatures, rerankerweights, or fromunifiedmodeldir input can make...

CVE-2026-126295

The NLTK library versions 3.10.0 through 3.10.3 are vulnerable to an arbitrary file read vulnerability within the BllipParser component. The root cause is the processing of unvalidated model paths , which allows an attacker to force the bllipparser C extension to read sensitive files outside of t...

EUVD-2026-125226

NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parsermodel, rerankerfeatures, rerankerweights, or fromunifiedmodeldir input can make...

CVE-2026-126295: nltk: NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to…

NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parsermodel, rerankerfeatures, rerankerweights, or fromunifiedmodeldir input can make...