Action not permitted
Modal body text goes here.
Modal Title
Modal Body
PYSEC-2026-3731
Vulnerability from pysec - Published: 2026-08-22 15:16 - Updated: 2026-09-01 08:54
VLAI
Details
NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.
Severity
Impacted products
| Name | purl | nltk | pkg:pypi/nltk |
|---|
Aliases
{
"affected": [
{
"ecosystem_specific": {},
"package": {
"ecosystem": "PyPI",
"name": "nltk",
"purl": "pkg:pypi/nltk"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.8",
"0.9",
"0.9.3",
"0.9.4",
"0.9.5",
"0.9.6",
"0.9.7",
"0.9.8",
"0.9.9",
"2.0.1",
"2.0.1rc1",
"2.0.1rc2-git",
"2.0.1rc3",
"2.0.1rc4",
"2.0.2",
"2.0.3",
"2.0.4",
"2.0.5",
"2.0b4",
"2.0b5",
"2.0b6",
"2.0b7",
"2.0b8",
"2.0b9",
"3.0.0",
"3.0.0b1",
"3.0.0b2",
"3.0.1",
"3.0.2",
"3.0.3",
"3.0.4",
"3.0.5",
"3.1",
"3.2",
"3.2.1",
"3.2.2",
"3.2.3",
"3.2.4",
"3.2.5",
"3.3",
"3.4",
"3.4.1",
"3.4.2",
"3.4.3",
"3.4.4",
"3.4.5",
"3.5",
"3.5b1",
"3.6",
"3.6.1",
"3.6.2",
"3.6.3",
"3.6.4",
"3.6.5",
"3.6.6",
"3.6.7",
"3.7",
"3.8",
"3.8.1",
"3.9",
"3.9.1",
"3.9.2",
"3.9.3",
"3.9.4",
"3.9b1"
]
}
],
"aliases": [
"CVE-2026-65915",
"GHSA-72r2-7mfr-5xr9"
],
"details": "NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.",
"id": "PYSEC-2026-3731",
"modified": "2026-09-01T08:54:51.735365Z",
"published": "2026-08-22T15:16:19.500Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.vulncheck.com/advisories/nltk-before-arbitrary-file-read-via-filesystempathpointer"
},
{
"type": "EVIDENCE",
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-72r2-7mfr-5xr9"
}
],
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
BREW-ACRONYM-CVE-2026-65915 (PYSEC-2026-3731)
Vulnerability from osv_homebrew – Published: 2026-09-02 08:43 – Updated: 2026-09-17 18:47 – Source website
VLAI
Summary
NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol
Details
Summary
There's a logic bug in FileSystemPathPointer.open() inside nltk/data.py
that makes the sandbox check permanently inert. The guard condition is always
False — meaning any file the process can read is accessible by passing a
file:// URL to nltk.data.load().
Details
In nltk/data.py, FileSystemPathPointer.open() was patched at some point
with a comment saying "SECURITY PATCH ENFORCING SANDBOX", but the check
doesn't work:
def open(self, encoding=None):
path = os.path.normpath(self._path)
# Block raw absolute reads such as "/" "C:\\Windows" etc.
if os.path.isabs(path) and path != os.path.normpath(self._path):
raise ValueError(f"Direct absolute file access blocked: {path}")
stream = open(self._path, "rb")
path is set to os.path.normpath(self._path) on line 1, then compared
against os.path.normpath(self._path) again in the condition. They are
always equal. The ValueError never fires.
On top of that, __init__ already calls os.path.abspath() before storing
self._path, so it's normalized before open() is even called. Running
normpath on it again changes nothing.
The stream = open(self._path, "rb") line is always reached regardless of
what path was passed in.
PoC
Tested on Python 3.11, NLTK 3.9.1, Ubuntu 22.04.
import nltk
from nltk.data import FileSystemPathPointer
# direct construction
ptr = FileSystemPathPointer("/etc/passwd")
with ptr.open() as f:
print(f.read(300))
# via load() using file:// URL
data = nltk.data.load("file:///etc/passwd", format="raw")
print(data[:300])
Both print file contents. No exception is raised.
Impact
Any app that lets users influence the string passed to nltk.data.load() or
nltk.data.find() is exposed — web APIs, notebook servers, multi-tenant
pipelines. An attacker can read any file the process user has access to:
/etc/passwd, .env files, private keys, ~/.aws/credentials, etc.
Suggested Fix
File: nltk/data.py — FileSystemPathPointer.open() (lines 378–390)
What's wrong
Line 387 compares normpath(self._path) against itself — always equal,
so the ValueError never fires. The check is dead code.
__init__ already calls abspath() on construction, so re-running
normpath inside open() changes nothing either.
Fix
Validate against the actual list of permitted data directories instead:
def open(self, encoding=None):
import nltk.data as _d
allowed = [os.path.abspath(p) for p in _d.path if p]
if allowed and not any(
os.path.commonpath([self._path, r]) == r for r in allowed
):
raise ValueError(
f"Access outside nltk_data blocked: {self._path!r}"
)
stream = open(self._path, "rb")
if encoding is not None:
stream = SeekableUnicodeStreamReader(stream, encoding)
return stream
Why commonpath not startswith
startswith is bypassable by a path that shares a prefix:
/tmp/nltk_data_evil".startswith("/tmp/nltk_data") → True ✗
commonpath(["/tmp/nltk_data_evil", "/tmp/nltk_data"]) → "/tmp" ✓
Diff
- path = os.path.normpath(self._path)
- if os.path.isabs(path) and path != os.path.normpath(self._path):
- raise ValueError(f"Direct absolute file access blocked: {path}")
-
+ import nltk.data as _d
+ allowed = [os.path.abspath(p) for p in _d.path if p]
+ if allowed and not any(
+ os.path.commonpath([self._path, r]) == r for r in allowed
+ ):
+ raise ValueError(f"Access outside nltk_data blocked: {self._path!r}")
stream = open(self._path, "rb")
Severity
6.5 (Medium)
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "nltk",
"resource_purl": "pkg:pypi/nltk@3.10.3",
"upstream_fixed_in": "3.10.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "acronym",
"purl": "pkg:brew/acronym"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.0_4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/nltk@3.10.3",
"name": "nltk",
"resource": "nltk",
"strategy": "registry",
"subject_version": "3.10.3"
}
]
},
"details": "### Summary\n\nThere\u0027s a logic bug in `FileSystemPathPointer.open()` inside `nltk/data.py`\nthat makes the sandbox check permanently inert. The guard condition is always\n`False` \u2014 meaning any file the process can read is accessible by passing a\n`file://` URL to `nltk.data.load()`.\n\n---\n\n### Details\n\nIn `nltk/data.py`, `FileSystemPathPointer.open()` was patched at some point\nwith a comment saying \"SECURITY PATCH ENFORCING SANDBOX\", but the check\ndoesn\u0027t work:\n```python\ndef open(self, encoding=None):\n path = os.path.normpath(self._path)\n\n # Block raw absolute reads such as \"/\" \"C:\\\\Windows\" etc.\n if os.path.isabs(path) and path != os.path.normpath(self._path):\n raise ValueError(f\"Direct absolute file access blocked: {path}\")\n\n stream = open(self._path, \"rb\")\n```\n\n`path` is set to `os.path.normpath(self._path)` on line 1, then compared\nagainst `os.path.normpath(self._path)` again in the condition. They are\nalways equal. The `ValueError` never fires.\n\nOn top of that, `__init__` already calls `os.path.abspath()` before storing\n`self._path`, so it\u0027s normalized before `open()` is even called. Running\n`normpath` on it again changes nothing.\n\nThe `stream = open(self._path, \"rb\")` line is always reached regardless of\nwhat path was passed in.\n\n---\n\n### PoC\n\nTested on Python 3.11, NLTK 3.9.1, Ubuntu 22.04.\n```python\nimport nltk\nfrom nltk.data import FileSystemPathPointer\n\n# direct construction\nptr = FileSystemPathPointer(\"/etc/passwd\")\nwith ptr.open() as f:\n print(f.read(300))\n\n# via load() using file:// URL\ndata = nltk.data.load(\"file:///etc/passwd\", format=\"raw\")\nprint(data[:300])\n```\n\nBoth print file contents. No exception is raised.\n\n---\n\n### Impact\n\nAny app that lets users influence the string passed to `nltk.data.load()` or\n`nltk.data.find()` is exposed \u2014 web APIs, notebook servers, multi-tenant\npipelines. An attacker can read any file the process user has access to:\n`/etc/passwd`, `.env` files, private keys, `~/.aws/credentials`, etc.\n\n## Suggested Fix\n\n**File:** `nltk/data.py` \u2014 `FileSystemPathPointer.open()` (lines 378\u2013390)\n\n### What\u0027s wrong\n\nLine 387 compares `normpath(self._path)` against itself \u2014 always equal,\nso the `ValueError` never fires. The check is dead code.\n`__init__` already calls `abspath()` on construction, so re-running\n`normpath` inside `open()` changes nothing either.\n\n---\n\n### Fix\n\nValidate against the actual list of permitted data directories instead:\n```python\ndef open(self, encoding=None):\n import nltk.data as _d\n allowed = [os.path.abspath(p) for p in _d.path if p]\n if allowed and not any(\n os.path.commonpath([self._path, r]) == r for r in allowed\n ):\n raise ValueError(\n f\"Access outside nltk_data blocked: {self._path!r}\"\n )\n stream = open(self._path, \"rb\")\n if encoding is not None:\n stream = SeekableUnicodeStreamReader(stream, encoding)\n return stream\n```\n\n---\n\n### Why `commonpath` not `startswith`\n\n`startswith` is bypassable by a path that shares a prefix:\n```\n/tmp/nltk_data_evil\".startswith(\"/tmp/nltk_data\") \u2192 True \u2717\ncommonpath([\"/tmp/nltk_data_evil\", \"/tmp/nltk_data\"]) \u2192 \"/tmp\" \u2713\n```\n\n---\n\n### Diff\n```diff\n- path = os.path.normpath(self._path)\n- if os.path.isabs(path) and path != os.path.normpath(self._path):\n- raise ValueError(f\"Direct absolute file access blocked: {path}\")\n-\n+ import nltk.data as _d\n+ allowed = [os.path.abspath(p) for p in _d.path if p]\n+ if allowed and not any(\n+ os.path.commonpath([self._path, r]) == r for r in allowed\n+ ):\n+ raise ValueError(f\"Access outside nltk_data blocked: {self._path!r}\")\n stream = open(self._path, \"rb\")\n```",
"id": "BREW-acronym-CVE-2026-65915",
"modified": "2026-09-17T18:47:55Z",
"published": "2026-09-02T08:43:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-72r2-7mfr-5xr9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65915"
},
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/pull/3522"
},
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/commit/69db9911fdba914ceeaca7aec6e892d1b14586a9"
},
{
"type": "PACKAGE",
"url": "https://github.com/nltk/nltk"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3731.yaml"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/a510de7b-ffaf-4a83-9bf8-fa7e63f4bd2d"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/nltk-before-arbitrary-file-read-via-filesystempathpointer"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "NLTK: FileSystemPathPointer.open() sandbox check is dead code \u2014 arbitrary file read via file:// protocol",
"upstream": [
"PYSEC-2026-3731",
"CVE-2026-65915",
"GHSA-72r2-7mfr-5xr9"
]
}
BREW-GPTLINE-CVE-2026-65915 (PYSEC-2026-3731)
Vulnerability from osv_homebrew – Published: 2026-09-02 09:04 – Updated: 2026-09-17 19:32 – Source website
VLAI
Summary
NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol
Details
Summary
There's a logic bug in FileSystemPathPointer.open() inside nltk/data.py
that makes the sandbox check permanently inert. The guard condition is always
False — meaning any file the process can read is accessible by passing a
file:// URL to nltk.data.load().
Details
In nltk/data.py, FileSystemPathPointer.open() was patched at some point
with a comment saying "SECURITY PATCH ENFORCING SANDBOX", but the check
doesn't work:
def open(self, encoding=None):
path = os.path.normpath(self._path)
# Block raw absolute reads such as "/" "C:\\Windows" etc.
if os.path.isabs(path) and path != os.path.normpath(self._path):
raise ValueError(f"Direct absolute file access blocked: {path}")
stream = open(self._path, "rb")
path is set to os.path.normpath(self._path) on line 1, then compared
against os.path.normpath(self._path) again in the condition. They are
always equal. The ValueError never fires.
On top of that, __init__ already calls os.path.abspath() before storing
self._path, so it's normalized before open() is even called. Running
normpath on it again changes nothing.
The stream = open(self._path, "rb") line is always reached regardless of
what path was passed in.
PoC
Tested on Python 3.11, NLTK 3.9.1, Ubuntu 22.04.
import nltk
from nltk.data import FileSystemPathPointer
# direct construction
ptr = FileSystemPathPointer("/etc/passwd")
with ptr.open() as f:
print(f.read(300))
# via load() using file:// URL
data = nltk.data.load("file:///etc/passwd", format="raw")
print(data[:300])
Both print file contents. No exception is raised.
Impact
Any app that lets users influence the string passed to nltk.data.load() or
nltk.data.find() is exposed — web APIs, notebook servers, multi-tenant
pipelines. An attacker can read any file the process user has access to:
/etc/passwd, .env files, private keys, ~/.aws/credentials, etc.
Suggested Fix
File: nltk/data.py — FileSystemPathPointer.open() (lines 378–390)
What's wrong
Line 387 compares normpath(self._path) against itself — always equal,
so the ValueError never fires. The check is dead code.
__init__ already calls abspath() on construction, so re-running
normpath inside open() changes nothing either.
Fix
Validate against the actual list of permitted data directories instead:
def open(self, encoding=None):
import nltk.data as _d
allowed = [os.path.abspath(p) for p in _d.path if p]
if allowed and not any(
os.path.commonpath([self._path, r]) == r for r in allowed
):
raise ValueError(
f"Access outside nltk_data blocked: {self._path!r}"
)
stream = open(self._path, "rb")
if encoding is not None:
stream = SeekableUnicodeStreamReader(stream, encoding)
return stream
Why commonpath not startswith
startswith is bypassable by a path that shares a prefix:
/tmp/nltk_data_evil".startswith("/tmp/nltk_data") → True ✗
commonpath(["/tmp/nltk_data_evil", "/tmp/nltk_data"]) → "/tmp" ✓
Diff
- path = os.path.normpath(self._path)
- if os.path.isabs(path) and path != os.path.normpath(self._path):
- raise ValueError(f"Direct absolute file access blocked: {path}")
-
+ import nltk.data as _d
+ allowed = [os.path.abspath(p) for p in _d.path if p]
+ if allowed and not any(
+ os.path.commonpath([self._path, r]) == r for r in allowed
+ ):
+ raise ValueError(f"Access outside nltk_data blocked: {self._path!r}")
stream = open(self._path, "rb")
Severity
6.5 (Medium)
References
| URL | Type | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "nltk",
"resource_purl": "pkg:pypi/nltk@3.10.3",
"upstream_fixed_in": "3.10.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "gptline",
"purl": "pkg:brew/gptline"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.8"
},
{
"fixed": "1.0.8_22"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/nltk@3.10.3",
"name": "nltk",
"resource": "nltk",
"strategy": "registry",
"subject_version": "3.10.3"
}
]
},
"details": "### Summary\n\nThere\u0027s a logic bug in `FileSystemPathPointer.open()` inside `nltk/data.py`\nthat makes the sandbox check permanently inert. The guard condition is always\n`False` \u2014 meaning any file the process can read is accessible by passing a\n`file://` URL to `nltk.data.load()`.\n\n---\n\n### Details\n\nIn `nltk/data.py`, `FileSystemPathPointer.open()` was patched at some point\nwith a comment saying \"SECURITY PATCH ENFORCING SANDBOX\", but the check\ndoesn\u0027t work:\n```python\ndef open(self, encoding=None):\n path = os.path.normpath(self._path)\n\n # Block raw absolute reads such as \"/\" \"C:\\\\Windows\" etc.\n if os.path.isabs(path) and path != os.path.normpath(self._path):\n raise ValueError(f\"Direct absolute file access blocked: {path}\")\n\n stream = open(self._path, \"rb\")\n```\n\n`path` is set to `os.path.normpath(self._path)` on line 1, then compared\nagainst `os.path.normpath(self._path)` again in the condition. They are\nalways equal. The `ValueError` never fires.\n\nOn top of that, `__init__` already calls `os.path.abspath()` before storing\n`self._path`, so it\u0027s normalized before `open()` is even called. Running\n`normpath` on it again changes nothing.\n\nThe `stream = open(self._path, \"rb\")` line is always reached regardless of\nwhat path was passed in.\n\n---\n\n### PoC\n\nTested on Python 3.11, NLTK 3.9.1, Ubuntu 22.04.\n```python\nimport nltk\nfrom nltk.data import FileSystemPathPointer\n\n# direct construction\nptr = FileSystemPathPointer(\"/etc/passwd\")\nwith ptr.open() as f:\n print(f.read(300))\n\n# via load() using file:// URL\ndata = nltk.data.load(\"file:///etc/passwd\", format=\"raw\")\nprint(data[:300])\n```\n\nBoth print file contents. No exception is raised.\n\n---\n\n### Impact\n\nAny app that lets users influence the string passed to `nltk.data.load()` or\n`nltk.data.find()` is exposed \u2014 web APIs, notebook servers, multi-tenant\npipelines. An attacker can read any file the process user has access to:\n`/etc/passwd`, `.env` files, private keys, `~/.aws/credentials`, etc.\n\n## Suggested Fix\n\n**File:** `nltk/data.py` \u2014 `FileSystemPathPointer.open()` (lines 378\u2013390)\n\n### What\u0027s wrong\n\nLine 387 compares `normpath(self._path)` against itself \u2014 always equal,\nso the `ValueError` never fires. The check is dead code.\n`__init__` already calls `abspath()` on construction, so re-running\n`normpath` inside `open()` changes nothing either.\n\n---\n\n### Fix\n\nValidate against the actual list of permitted data directories instead:\n```python\ndef open(self, encoding=None):\n import nltk.data as _d\n allowed = [os.path.abspath(p) for p in _d.path if p]\n if allowed and not any(\n os.path.commonpath([self._path, r]) == r for r in allowed\n ):\n raise ValueError(\n f\"Access outside nltk_data blocked: {self._path!r}\"\n )\n stream = open(self._path, \"rb\")\n if encoding is not None:\n stream = SeekableUnicodeStreamReader(stream, encoding)\n return stream\n```\n\n---\n\n### Why `commonpath` not `startswith`\n\n`startswith` is bypassable by a path that shares a prefix:\n```\n/tmp/nltk_data_evil\".startswith(\"/tmp/nltk_data\") \u2192 True \u2717\ncommonpath([\"/tmp/nltk_data_evil\", \"/tmp/nltk_data\"]) \u2192 \"/tmp\" \u2713\n```\n\n---\n\n### Diff\n```diff\n- path = os.path.normpath(self._path)\n- if os.path.isabs(path) and path != os.path.normpath(self._path):\n- raise ValueError(f\"Direct absolute file access blocked: {path}\")\n-\n+ import nltk.data as _d\n+ allowed = [os.path.abspath(p) for p in _d.path if p]\n+ if allowed and not any(\n+ os.path.commonpath([self._path, r]) == r for r in allowed\n+ ):\n+ raise ValueError(f\"Access outside nltk_data blocked: {self._path!r}\")\n stream = open(self._path, \"rb\")\n```",
"id": "BREW-gptline-CVE-2026-65915",
"modified": "2026-09-17T19:32:01Z",
"published": "2026-09-02T09:04:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-72r2-7mfr-5xr9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65915"
},
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/pull/3522"
},
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/commit/69db9911fdba914ceeaca7aec6e892d1b14586a9"
},
{
"type": "PACKAGE",
"url": "https://github.com/nltk/nltk"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3731.yaml"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/a510de7b-ffaf-4a83-9bf8-fa7e63f4bd2d"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/nltk-before-arbitrary-file-read-via-filesystempathpointer"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "NLTK: FileSystemPathPointer.open() sandbox check is dead code \u2014 arbitrary file read via file:// protocol",
"upstream": [
"PYSEC-2026-3731",
"CVE-2026-65915",
"GHSA-72r2-7mfr-5xr9"
]
}
BREW-SAFETY-CVE-2026-65915 (PYSEC-2026-3731)
Vulnerability from osv_homebrew – Published: 2026-09-02 09:53 – Updated: 2026-09-17 17:35 – Source website
VLAI
Summary
NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol
Details
Summary
There's a logic bug in FileSystemPathPointer.open() inside nltk/data.py
that makes the sandbox check permanently inert. The guard condition is always
False — meaning any file the process can read is accessible by passing a
file:// URL to nltk.data.load().
Details
In nltk/data.py, FileSystemPathPointer.open() was patched at some point
with a comment saying "SECURITY PATCH ENFORCING SANDBOX", but the check
doesn't work:
def open(self, encoding=None):
path = os.path.normpath(self._path)
# Block raw absolute reads such as "/" "C:\\Windows" etc.
if os.path.isabs(path) and path != os.path.normpath(self._path):
raise ValueError(f"Direct absolute file access blocked: {path}")
stream = open(self._path, "rb")
path is set to os.path.normpath(self._path) on line 1, then compared
against os.path.normpath(self._path) again in the condition. They are
always equal. The ValueError never fires.
On top of that, __init__ already calls os.path.abspath() before storing
self._path, so it's normalized before open() is even called. Running
normpath on it again changes nothing.
The stream = open(self._path, "rb") line is always reached regardless of
what path was passed in.
PoC
Tested on Python 3.11, NLTK 3.9.1, Ubuntu 22.04.
import nltk
from nltk.data import FileSystemPathPointer
# direct construction
ptr = FileSystemPathPointer("/etc/passwd")
with ptr.open() as f:
print(f.read(300))
# via load() using file:// URL
data = nltk.data.load("file:///etc/passwd", format="raw")
print(data[:300])
Both print file contents. No exception is raised.
Impact
Any app that lets users influence the string passed to nltk.data.load() or
nltk.data.find() is exposed — web APIs, notebook servers, multi-tenant
pipelines. An attacker can read any file the process user has access to:
/etc/passwd, .env files, private keys, ~/.aws/credentials, etc.
Suggested Fix
File: nltk/data.py — FileSystemPathPointer.open() (lines 378–390)
What's wrong
Line 387 compares normpath(self._path) against itself — always equal,
so the ValueError never fires. The check is dead code.
__init__ already calls abspath() on construction, so re-running
normpath inside open() changes nothing either.
Fix
Validate against the actual list of permitted data directories instead:
def open(self, encoding=None):
import nltk.data as _d
allowed = [os.path.abspath(p) for p in _d.path if p]
if allowed and not any(
os.path.commonpath([self._path, r]) == r for r in allowed
):
raise ValueError(
f"Access outside nltk_data blocked: {self._path!r}"
)
stream = open(self._path, "rb")
if encoding is not None:
stream = SeekableUnicodeStreamReader(stream, encoding)
return stream
Why commonpath not startswith
startswith is bypassable by a path that shares a prefix:
/tmp/nltk_data_evil".startswith("/tmp/nltk_data") → True ✗
commonpath(["/tmp/nltk_data_evil", "/tmp/nltk_data"]) → "/tmp" ✓
Diff
- path = os.path.normpath(self._path)
- if os.path.isabs(path) and path != os.path.normpath(self._path):
- raise ValueError(f"Direct absolute file access blocked: {path}")
-
+ import nltk.data as _d
+ allowed = [os.path.abspath(p) for p in _d.path if p]
+ if allowed and not any(
+ os.path.commonpath([self._path, r]) == r for r in allowed
+ ):
+ raise ValueError(f"Access outside nltk_data blocked: {self._path!r}")
stream = open(self._path, "rb")
Severity
6.5 (Medium)
References
| URL | Type | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "nltk",
"resource_purl": "pkg:pypi/nltk@3.10.3",
"upstream_fixed_in": "3.10.0"
},
"package": {
"ecosystem": "Homebrew",
"name": "safety",
"purl": "pkg:brew/safety"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.1"
},
{
"fixed": "3.8.1_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/nltk@3.10.3",
"name": "nltk",
"resource": "nltk",
"strategy": "registry",
"subject_version": "3.10.3"
}
]
},
"details": "### Summary\n\nThere\u0027s a logic bug in `FileSystemPathPointer.open()` inside `nltk/data.py`\nthat makes the sandbox check permanently inert. The guard condition is always\n`False` \u2014 meaning any file the process can read is accessible by passing a\n`file://` URL to `nltk.data.load()`.\n\n---\n\n### Details\n\nIn `nltk/data.py`, `FileSystemPathPointer.open()` was patched at some point\nwith a comment saying \"SECURITY PATCH ENFORCING SANDBOX\", but the check\ndoesn\u0027t work:\n```python\ndef open(self, encoding=None):\n path = os.path.normpath(self._path)\n\n # Block raw absolute reads such as \"/\" \"C:\\\\Windows\" etc.\n if os.path.isabs(path) and path != os.path.normpath(self._path):\n raise ValueError(f\"Direct absolute file access blocked: {path}\")\n\n stream = open(self._path, \"rb\")\n```\n\n`path` is set to `os.path.normpath(self._path)` on line 1, then compared\nagainst `os.path.normpath(self._path)` again in the condition. They are\nalways equal. The `ValueError` never fires.\n\nOn top of that, `__init__` already calls `os.path.abspath()` before storing\n`self._path`, so it\u0027s normalized before `open()` is even called. Running\n`normpath` on it again changes nothing.\n\nThe `stream = open(self._path, \"rb\")` line is always reached regardless of\nwhat path was passed in.\n\n---\n\n### PoC\n\nTested on Python 3.11, NLTK 3.9.1, Ubuntu 22.04.\n```python\nimport nltk\nfrom nltk.data import FileSystemPathPointer\n\n# direct construction\nptr = FileSystemPathPointer(\"/etc/passwd\")\nwith ptr.open() as f:\n print(f.read(300))\n\n# via load() using file:// URL\ndata = nltk.data.load(\"file:///etc/passwd\", format=\"raw\")\nprint(data[:300])\n```\n\nBoth print file contents. No exception is raised.\n\n---\n\n### Impact\n\nAny app that lets users influence the string passed to `nltk.data.load()` or\n`nltk.data.find()` is exposed \u2014 web APIs, notebook servers, multi-tenant\npipelines. An attacker can read any file the process user has access to:\n`/etc/passwd`, `.env` files, private keys, `~/.aws/credentials`, etc.\n\n## Suggested Fix\n\n**File:** `nltk/data.py` \u2014 `FileSystemPathPointer.open()` (lines 378\u2013390)\n\n### What\u0027s wrong\n\nLine 387 compares `normpath(self._path)` against itself \u2014 always equal,\nso the `ValueError` never fires. The check is dead code.\n`__init__` already calls `abspath()` on construction, so re-running\n`normpath` inside `open()` changes nothing either.\n\n---\n\n### Fix\n\nValidate against the actual list of permitted data directories instead:\n```python\ndef open(self, encoding=None):\n import nltk.data as _d\n allowed = [os.path.abspath(p) for p in _d.path if p]\n if allowed and not any(\n os.path.commonpath([self._path, r]) == r for r in allowed\n ):\n raise ValueError(\n f\"Access outside nltk_data blocked: {self._path!r}\"\n )\n stream = open(self._path, \"rb\")\n if encoding is not None:\n stream = SeekableUnicodeStreamReader(stream, encoding)\n return stream\n```\n\n---\n\n### Why `commonpath` not `startswith`\n\n`startswith` is bypassable by a path that shares a prefix:\n```\n/tmp/nltk_data_evil\".startswith(\"/tmp/nltk_data\") \u2192 True \u2717\ncommonpath([\"/tmp/nltk_data_evil\", \"/tmp/nltk_data\"]) \u2192 \"/tmp\" \u2713\n```\n\n---\n\n### Diff\n```diff\n- path = os.path.normpath(self._path)\n- if os.path.isabs(path) and path != os.path.normpath(self._path):\n- raise ValueError(f\"Direct absolute file access blocked: {path}\")\n-\n+ import nltk.data as _d\n+ allowed = [os.path.abspath(p) for p in _d.path if p]\n+ if allowed and not any(\n+ os.path.commonpath([self._path, r]) == r for r in allowed\n+ ):\n+ raise ValueError(f\"Access outside nltk_data blocked: {self._path!r}\")\n stream = open(self._path, \"rb\")\n```",
"id": "BREW-safety-CVE-2026-65915",
"modified": "2026-09-17T17:35:56Z",
"published": "2026-09-02T09:53:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-72r2-7mfr-5xr9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65915"
},
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/pull/3522"
},
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/commit/69db9911fdba914ceeaca7aec6e892d1b14586a9"
},
{
"type": "PACKAGE",
"url": "https://github.com/nltk/nltk"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3731.yaml"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/a510de7b-ffaf-4a83-9bf8-fa7e63f4bd2d"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/nltk-before-arbitrary-file-read-via-filesystempathpointer"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "NLTK: FileSystemPathPointer.open() sandbox check is dead code \u2014 arbitrary file read via file:// protocol",
"upstream": [
"PYSEC-2026-3731",
"CVE-2026-65915",
"GHSA-72r2-7mfr-5xr9"
]
}
CVE-2026-65915 (GCVE-0-2026-65915)
Vulnerability from cvelistv5 – Published: 2026-08-22 14:12 – Updated: 2026-08-24 19:20
VLAI
EPSS
VEX
Title
NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer
Summary
NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 19:20 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/nltk/nltk/security/advisories/… | vendor-advisory |
| https://www.vulncheck.com/advisories/nltk-before-… | third-party-advisory |
Impacted products
Date Public
2026-08-07 00:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65915",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T19:20:34.826563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T19:20:52.747Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-72r2-7mfr-5xr9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/nltk",
"product": "nltk",
"vendor": "nltk",
"versions": [
{
"lessThan": "3.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.10.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ZeroXJacks"
}
],
"datePublic": "2026-08-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T14:12:41.391Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-72r2-7mfr-5xr9)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-72r2-7mfr-5xr9"
},
{
"name": "VulnCheck Advisory: NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nltk-before-arbitrary-file-read-via-filesystempathpointer"
}
],
"title": "NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-65915",
"datePublished": "2026-08-22T14:12:41.391Z",
"dateReserved": "2026-07-23T12:51:09.595Z",
"dateUpdated": "2026-08-24T19:20:52.747Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GHSA-72R2-7MFR-5XR9
Vulnerability from github – Published: 2026-09-08 15:27 – Updated: 2026-09-08 15:27
VLAI
Summary
NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol
Details
Summary
There's a logic bug in FileSystemPathPointer.open() inside nltk/data.py
that makes the sandbox check permanently inert. The guard condition is always
False — meaning any file the process can read is accessible by passing a
file:// URL to nltk.data.load().
Details
In nltk/data.py, FileSystemPathPointer.open() was patched at some point
with a comment saying "SECURITY PATCH ENFORCING SANDBOX", but the check
doesn't work:
def open(self, encoding=None):
path = os.path.normpath(self._path)
# Block raw absolute reads such as "/" "C:\\Windows" etc.
if os.path.isabs(path) and path != os.path.normpath(self._path):
raise ValueError(f"Direct absolute file access blocked: {path}")
stream = open(self._path, "rb")
path is set to os.path.normpath(self._path) on line 1, then compared
against os.path.normpath(self._path) again in the condition. They are
always equal. The ValueError never fires.
On top of that, __init__ already calls os.path.abspath() before storing
self._path, so it's normalized before open() is even called. Running
normpath on it again changes nothing.
The stream = open(self._path, "rb") line is always reached regardless of
what path was passed in.
PoC
Tested on Python 3.11, NLTK 3.9.1, Ubuntu 22.04.
import nltk
from nltk.data import FileSystemPathPointer
# direct construction
ptr = FileSystemPathPointer("/etc/passwd")
with ptr.open() as f:
print(f.read(300))
# via load() using file:// URL
data = nltk.data.load("file:///etc/passwd", format="raw")
print(data[:300])
Both print file contents. No exception is raised.
Impact
Any app that lets users influence the string passed to nltk.data.load() or
nltk.data.find() is exposed — web APIs, notebook servers, multi-tenant
pipelines. An attacker can read any file the process user has access to:
/etc/passwd, .env files, private keys, ~/.aws/credentials, etc.
Suggested Fix
File: nltk/data.py — FileSystemPathPointer.open() (lines 378–390)
What's wrong
Line 387 compares normpath(self._path) against itself — always equal,
so the ValueError never fires. The check is dead code.
__init__ already calls abspath() on construction, so re-running
normpath inside open() changes nothing either.
Fix
Validate against the actual list of permitted data directories instead:
def open(self, encoding=None):
import nltk.data as _d
allowed = [os.path.abspath(p) for p in _d.path if p]
if allowed and not any(
os.path.commonpath([self._path, r]) == r for r in allowed
):
raise ValueError(
f"Access outside nltk_data blocked: {self._path!r}"
)
stream = open(self._path, "rb")
if encoding is not None:
stream = SeekableUnicodeStreamReader(stream, encoding)
return stream
Why commonpath not startswith
startswith is bypassable by a path that shares a prefix:
/tmp/nltk_data_evil".startswith("/tmp/nltk_data") → True ✗
commonpath(["/tmp/nltk_data_evil", "/tmp/nltk_data"]) → "/tmp" ✓
Diff
- path = os.path.normpath(self._path)
- if os.path.isabs(path) and path != os.path.normpath(self._path):
- raise ValueError(f"Direct absolute file access blocked: {path}")
-
+ import nltk.data as _d
+ allowed = [os.path.abspath(p) for p in _d.path if p]
+ if allowed and not any(
+ os.path.commonpath([self._path, r]) == r for r in allowed
+ ):
+ raise ValueError(f"Access outside nltk_data blocked: {self._path!r}")
stream = open(self._path, "rb")
Severity
6.5 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.9.3"
},
"package": {
"ecosystem": "PyPI",
"name": "nltk"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-65915"
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-08T15:27:12Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nThere\u0027s a logic bug in `FileSystemPathPointer.open()` inside `nltk/data.py`\nthat makes the sandbox check permanently inert. The guard condition is always\n`False` \u2014 meaning any file the process can read is accessible by passing a\n`file://` URL to `nltk.data.load()`.\n\n---\n\n### Details\n\nIn `nltk/data.py`, `FileSystemPathPointer.open()` was patched at some point\nwith a comment saying \"SECURITY PATCH ENFORCING SANDBOX\", but the check\ndoesn\u0027t work:\n```python\ndef open(self, encoding=None):\n path = os.path.normpath(self._path)\n\n # Block raw absolute reads such as \"/\" \"C:\\\\Windows\" etc.\n if os.path.isabs(path) and path != os.path.normpath(self._path):\n raise ValueError(f\"Direct absolute file access blocked: {path}\")\n\n stream = open(self._path, \"rb\")\n```\n\n`path` is set to `os.path.normpath(self._path)` on line 1, then compared\nagainst `os.path.normpath(self._path)` again in the condition. They are\nalways equal. The `ValueError` never fires.\n\nOn top of that, `__init__` already calls `os.path.abspath()` before storing\n`self._path`, so it\u0027s normalized before `open()` is even called. Running\n`normpath` on it again changes nothing.\n\nThe `stream = open(self._path, \"rb\")` line is always reached regardless of\nwhat path was passed in.\n\n---\n\n### PoC\n\nTested on Python 3.11, NLTK 3.9.1, Ubuntu 22.04.\n```python\nimport nltk\nfrom nltk.data import FileSystemPathPointer\n\n# direct construction\nptr = FileSystemPathPointer(\"/etc/passwd\")\nwith ptr.open() as f:\n print(f.read(300))\n\n# via load() using file:// URL\ndata = nltk.data.load(\"file:///etc/passwd\", format=\"raw\")\nprint(data[:300])\n```\n\nBoth print file contents. No exception is raised.\n\n---\n\n### Impact\n\nAny app that lets users influence the string passed to `nltk.data.load()` or\n`nltk.data.find()` is exposed \u2014 web APIs, notebook servers, multi-tenant\npipelines. An attacker can read any file the process user has access to:\n`/etc/passwd`, `.env` files, private keys, `~/.aws/credentials`, etc.\n\n## Suggested Fix\n\n**File:** `nltk/data.py` \u2014 `FileSystemPathPointer.open()` (lines 378\u2013390)\n\n### What\u0027s wrong\n\nLine 387 compares `normpath(self._path)` against itself \u2014 always equal,\nso the `ValueError` never fires. The check is dead code.\n`__init__` already calls `abspath()` on construction, so re-running\n`normpath` inside `open()` changes nothing either.\n\n---\n\n### Fix\n\nValidate against the actual list of permitted data directories instead:\n```python\ndef open(self, encoding=None):\n import nltk.data as _d\n allowed = [os.path.abspath(p) for p in _d.path if p]\n if allowed and not any(\n os.path.commonpath([self._path, r]) == r for r in allowed\n ):\n raise ValueError(\n f\"Access outside nltk_data blocked: {self._path!r}\"\n )\n stream = open(self._path, \"rb\")\n if encoding is not None:\n stream = SeekableUnicodeStreamReader(stream, encoding)\n return stream\n```\n\n---\n\n### Why `commonpath` not `startswith`\n\n`startswith` is bypassable by a path that shares a prefix:\n```\n/tmp/nltk_data_evil\".startswith(\"/tmp/nltk_data\") \u2192 True \u2717\ncommonpath([\"/tmp/nltk_data_evil\", \"/tmp/nltk_data\"]) \u2192 \"/tmp\" \u2713\n```\n\n---\n\n### Diff\n```diff\n- path = os.path.normpath(self._path)\n- if os.path.isabs(path) and path != os.path.normpath(self._path):\n- raise ValueError(f\"Direct absolute file access blocked: {path}\")\n-\n+ import nltk.data as _d\n+ allowed = [os.path.abspath(p) for p in _d.path if p]\n+ if allowed and not any(\n+ os.path.commonpath([self._path, r]) == r for r in allowed\n+ ):\n+ raise ValueError(f\"Access outside nltk_data blocked: {self._path!r}\")\n stream = open(self._path, \"rb\")\n```",
"id": "GHSA-72r2-7mfr-5xr9",
"modified": "2026-09-08T15:27:12Z",
"published": "2026-09-08T15:27:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-72r2-7mfr-5xr9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65915"
},
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/pull/3522"
},
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/commit/69db9911fdba914ceeaca7aec6e892d1b14586a9"
},
{
"type": "PACKAGE",
"url": "https://github.com/nltk/nltk"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3731.yaml"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/a510de7b-ffaf-4a83-9bf8-fa7e63f4bd2d"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/nltk-before-arbitrary-file-read-via-filesystempathpointer"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "NLTK: FileSystemPathPointer.open() sandbox check is dead code \u2014 arbitrary file read via file:// protocol"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…
Loading…