EUVD-2026-64333

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...

CVE-2026-63312

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView . The root cause is that the component calls builtins.open() directly instead of the sandboxed pathsec.open() , effectively bypassing the pathsec.ENFORCE security mechanism. An attacker who controls t...

CVE-2026-62383

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in the IPIPANCorpusReader component. The root cause is a complete bypass of nltk.pathsec validation: an attacker with local access can place a symlink in the corpus root directory and invoke channels(), domains(...

EUVD-2026-64339

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels,...

CVE-2026-71514

NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader._load_lang_ngrams . The function joins the corpus root with a value read from the corpus table.txt mapping file and opens the result using the builtin open() instead of the pathsec -validated opener. Because...