Executive brief
The Natural Language Toolkit (NLTK), a popular Python library for processing human language data, contains a security flaw in its FrameNet corpus reader. This vulnerability allows an attacker to bypass built-in security sandboxes and read sensitive XML files from the underlying server that they should not have access to. This could lead to the exposure of private application data, configuration files, or credentials if the application processes user-supplied input through this component.
Technical details
A path traversal vulnerability exists in NLTK's FramenetCorpusReader.frame() method due to improper sanitization of the 'name' parameter. The method interpolates the user-supplied name directly into a file path and uses the Python builtin open() via XMLCorpusView, rather than the protected CorpusReader.open() interface. This bypasses the nltk.pathsec validation logic, including strict ENFORCE=True mode. An attacker can use '../' sequences to escape the corpus root and read arbitrary XML files reachable by the process. Sibling methods doc() and the lexical-unit loader are also affected via malicious corpus metadata. The issue is resolved in version 3.10.0.
Affected products
- nltk nltk <= 3.9.4
Timeline
- 2026-06-11: disclosed
- 2026-06-15: advisory: NVD publication date
- 2026-07-31: patched: GitHub Advisory reviewed and published