Junglewise Threat Intelligence

CVE-2026-62388: NLTK pathsec insecure default configuration

CVE-2026-62388 · Severity: high · CVSS 8.7 · Published 2026-09-02

Executive brief

NLTK is a natural language processing library widely used in Python applications for text analysis and data processing. The library includes a security module (pathsec) designed to prevent dangerous operations like arbitrary file access and unsafe deserialization. However, this security module is disabled by default, meaning applications using NLTK 3.9.x are vulnerable to file reading and remote code execution attacks unless administrators manually enable the security controls via an environment variable.

Technical details

NLTK's pathsec.py module contains 8 security validation functions that gate access to sensitive operations: file access, network URL validation, and pickle deserialization. Each validation function checks for security violations and conditionally raises SecurityError or emits RuntimeWarning based on the ENFORCE variable, which defaults to False unless the environment variable NLTK_PATHSEC_ENFORCE is explicitly set to '1', 'true', or 'yes'. With ENFORCE=False, violations only trigger warnings and execution proceeds (e.g., pathsec.open('/etc/passwd') succeeds and returns a file handle). This default makes the security controls opt-in rather than fail-secure, allowing attackers to exploit the underlying vulnerabilities (arbitrary code execution via pickle, path traversal) when using NLTK 3.9.4 and earlier. The vulnerability was introduced when pathsec was added as a remediation for the prior CVEs but with an unsafe default. The fix (available in NLTK 3.10.0+) changes the default to ENFORCE=True, with an environment variable allowing explicit opt-out for backwards compatibility.

Affected products

  • NLTK Project NLTK <= 3.9.4

Timeline

  • 2026-08-07: disclosed
  • 2026-06-05: patched: Fix merged in PR #3593; released in NLTK 3.10.0
  • 2026-09-02: advisory

References

Related threats