NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

Summary IPIPANCorpusReader nltk/corpus/reader/ipipan.py exposes public methods, channels, domains, categories, and fileidschannels=..., that accept a caller supplied fileids list and read a file via a completely unprotected builtin open call, with no nltk.pathsec involvement at all. A symlink...

The vulnerability of the validate_network_url() function in the nltk.pathsec component of the NLTK library for symbolic and statistical processing of natural language allows a attacker to perform an SSRF attack.

The vulnerability of the validatenetworkurl function in the nltk.pathsec component of the NLTK library, a software library for symbolic and statistical processing of natural language, is related to insufficient validation of requests on the server side. Exploiting this vulnerability may allow a...