Executive brief
NLTK is a natural language processing library commonly used in NLP pipelines and web applications. Applications that enable NLTK's strict file-access control mode (pathsec.ENFORCE = True) are intended to prevent unauthorized file reads. However, the StreamBackedCorpusView class bypasses this protection, allowing attackers who can influence file path parameters to read any file on the system, including system configuration files and sensitive credentials stored in environment variables or config files.
Technical details
The vulnerability is a security control bypass (CWE-22, CWE-284). StreamBackedCorpusView._open() in nltk/corpus/reader/util.py calls builtins.open() and os.stat() directly on line 171 and 208, rather than routing through nltk.pathsec.open() which enforces path validation via pathsec.validate_path(). When user input controls the fileid argument (common in REST APIs and web apps serving NLTK-based NLP), an unauthenticated attacker can request arbitrary file paths such as /etc/passwd, /proc/self/environ, or application config files. The attack requires network access but no privileges. XMLCorpusView and other corpus reader subclasses passing string fileids are also affected. The fix, available in NLTK 3.10.0, replaces direct builtins.open() calls with nltk.pathsec.open().
Affected products
- NLTK NLTK <= 3.9.4
Timeline
- 2026-09-08: disclosed: GHSA-x5ph-mj9p-rfr8 and CVE-2026-63312 published
- 2026: patched: Fixed in NLTK 3.10.0