Duplicate Advisory: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fg9w-wfp5-j933. This link is maintained to preserve external references. Original Description NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to...

CVE-2026-126295

The NLTK library versions 3.10.0 through 3.10.3 are vulnerable to an arbitrary file read vulnerability within the BllipParser component. The root cause is the processing of unvalidated model paths , which allows an attacker to force the bllipparser C extension to read sensitive files outside of t...

EUVD-2026-125226

NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parsermodel, rerankerfeatures, rerankerweights, or fromunifiedmodeldir input can make...