Executive brief
NLTK is a Python library commonly used in natural language processing applications and data science workflows. A flaw in its file loading function allows attackers to read any file on the system that the application process can access (such as /etc/passwd, environment files with credentials, or private keys) by passing specially crafted file:// URLs. This is particularly dangerous in web applications, notebook servers, or multi-tenant environments where user input influences file paths.
Technical details
The vulnerability is a dead-code logic error in FileSystemPathPointer.open() within nltk/data.py (lines 378–390). The check intended to block absolute file access compares os.path.normpath(self._path) against itself—they are always equal, so the ValueError guard never executes. Additionally, __init__ already calls os.path.abspath(), so re-running normpath in open() has no effect. Consequently, the stream = open(self._path, "rb") line is always reached regardless of the path provided. An attacker can exploit this by passing file:// URLs to nltk.data.load() or calling FileSystemPathPointer directly with any path the process user can read. The vulnerability requires low privileges (no special user rights) and is accessible over the network if the vulnerable code is exposed via a web API. Patched in NLTK 3.10.0; affected versions are ≤ 3.9.3.
Affected products
- NLTK NLTK <= 3.9.3
Timeline
- 2026-09-08: disclosed: Published to GitHub Advisory Database
- 2026-08-07: advisory: GitHub security advisory published
- 2026-09-01: patched: Patched in NLTK 3.10.0