CVE-2026-71514
LowCVSS 2.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open() rather than the pathsec-validated opener, so os.path.join discards the root when that value is absolute and the read escapes the corpus directory without the containment check nltk.pathsec applies when ENFORCE is set. An attacker who controls a corpus package can disclose file contents outside the corpus root through lang_freq, limited to paths ending in -3grams.txt whose contents parse as token count lines.
Risk Assessment
The risk includes disclosure of file contents outside the corpus directory, potentially leading to sensitive data leakage if an attacker can supply a malicious corpus package.
Recommendation
Update NLTK to a patched version and implement path validation and file access restrictions.
Other vulnerabilities in NLTK
See all- CVE-2026-81723Low
NLTK before 3.10.3 has a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment(). Malformed XML files can cause severe CPU consumption and DoS.
- CVE-2026-80206Medium
NLTK before 3.10.3 has a ReDoS vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regex patterns and executes them without validation, potentially causing catastrophic backtracking and blocking the Python process.
- CVE-2026-80205High
NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.
- CVE-2026-79675Critical
NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.
- CVE-2026-79657Critical
NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer._execute and numpy.f2py.crackfortran.myeval through pickle REDUCE to execute arbitrary commands during model or tokenizer artifact loading.
- CVE-2026-78683Critical
NLTK before 3.10.0 contains an unsafe pickle deserialization vulnerability in TransitionParser.parse(). Deserialization uses default restricted=False, allowing arbitrary Python code execution when loading a crafted model file.
- CVE-2026-81727High
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction.
- CVE-2026-81726High
NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.
- CVE-2026-81725Low
NLTK before 3.10.3 has a regular expression denial of service vulnerability in Pl196xCorpusReader. Attackers can supply malformed TEI blocks causing quadratic CPU consumption.
- CVE-2026-81724Medium
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.
Original NVD description (English source)
NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open() rather than the pathsec-validated opener, so os.path.join discards the root when that value is absolute and the read escapes the corpus directory without the containment check nltk.pathsec applies when ENFORCE is set. An attacker who controls a corpus package can disclose file contents outside the corpus root through lang_freq, limited to paths ending in -3grams.txt whose contents parse as token count lines.