CVE-2026-63312

A flaw was found in NLTK. This vulnerability, specifically within the StreamBackedCorpusView component, allows an attacker to bypass security enforcement by directly calling builtins.open instead of the intended pathsec.open. By controlling the fileid argument, an attacker can read arbitrary loca...