CVE-2026-54293: NLTK path traversal via URL-encoded separators in nltk.data.load

CVE-2026-54293 · Severity: high · CVSS 7.5 · Published 2026-06-22

The Natural Language Toolkit (NLTK), a popular Python library for processing human language data, contains a security flaw that allows unauthorized access to files on the host system. By providing specially crafted, encoded file paths to certain NLTK functions, an attacker can bypass security filters to read sensitive information such as system passwords, API keys, or configuration files. This poses a significant risk to web applications, hosted notebooks, and automated data pipelines that use NLTK to process user-supplied input.

Technologies: NLTK Project Natural Language Toolkit, nltk (PyPI). Vendors: NLTK Project, PyPI.

Quick answers

Is CVE-2026-54293 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54293 being exploited in the wild.
How severe is CVE-2026-54293?
High severity, with a CVSS score of 7.5, published 22 June 2026.
Which products and versions are affected?
NLTK Project Natural Language Toolkit <= 3.9.4; nltk (PyPI) <= 3.9.4, ECOSYSTEM:introduced=0,fixed=3.10.0.
Is there a fix for CVE-2026-54293?
Yes. nltk (PyPI): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54293 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54293?
Check whether you run NLTK Project Natural Language Toolkit or nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nltk (PyPI): upgrade to 3.10.0 or later
    pip install "nltk>=3.10.0"

Technical details

A path traversal vulnerability exists in `nltk.data.load()` and `find()` due to a 'decode-after-check' flaw. The library uses a regular expression (`_UNSAFE_NO_PROTOCOL_RE`) to block traversal sequences like '../' and absolute paths, but this check is performed on raw input before URL-decoding occurs. An attacker can bypass this protection by using URL-encoded characters such as '%2f' for slashes or '%2e%2e' for dots. When the `nltk:` URL scheme is processed, `url2pathname()` subsequently decodes these sequences into a valid filesystem path, allowing the retrieval of sensitive files (e.g., /etc/passwd or /proc/self/environ). This issue is resolved in version 3.10.0-rc1 by ensuring inputs are decoded before safety validation.

Affected products

  • nltk nltk < 3.10.0-rc1

Identifiers

  • CVE-2026-54293
  • GHSA-p4gq-832x-fm9v
  • PYSEC-2026-2078

Timeline

  • 2026-05-14: other: Pull request to fix the issue submitted
  • 2026-06-06: patched: Fix merged into develop branch
  • 2026-06-11: advisory: GitHub Security Advisory published
  • 2026-06-22: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.