CVE-2026-126302

NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sqlquery that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox...

EUVD-2026-125219

NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sqlquery that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox...

CVE-2026-126302 NLTK 3.9.4 before 3.10.4 Symlink Sandbox Escape via chat80.sql_query

NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sqlquery that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox...

CVE-2026-126302

The NLTK library versions 3.9.4 before 3.10.4 is vulnerable to a symlink following flaw in the nltk.sem.chat80.sql_query() function. This vulnerability allows an attacker who has write access to a trusted NLTK data root to plant a symbolic link , effectively bypassing the pathsec data-root sandbo...