Executive brief
NLTK is a popular Python library for natural language processing that includes a security module (pathsec) designed to prevent applications from accidentally fetching data from internal or private networks. However, when an HTTP proxy is configured on the system, this protection can be circumvented—an attacker with network access to the proxy could trick NLTK into retrieving sensitive internal resources, forged package indexes, or malicious code archives that would normally be inaccessible. This is particularly dangerous for systems that rely on NLTK to safely download language datasets or packages from the internet.
Technical details
This is a Server-Side Request Forgery (SSRF) vulnerability in the pathsec module's HTTP/HTTPS handling. The root cause is that `pathsec.urlopen()` validates the requested hostname and pins the destination IP for direct connections, but when proxy handlers are inherited from the global opener (via `ProxyHandler` instances), the `_SafeHTTPHandler` and `_SafeHTTPSHandler` security handlers are bypassed. This means the validated hostname no longer matches the actual egress destination—the proxy can redirect the validated request to any internal target. The vulnerability affects `nltk.pathsec.urlopen()`, `nltk.data.load()`, `nltk.downloader.Downloader.index()`, and `nltk.downloader.Downloader.download()`. An attacker requires the ability to configure or control a proxy on the target network (or via environment variables) and must set up a malicious proxy that redirects validated public URLs to internal services. Patch 3.10.3 introduces an `ENFORCE` mode (default enabled) that refuses proxied fetches entirely, with an opt-in escape hatch via `NLTK_ALLOW_PROXIED_URLOPEN=1` or `nltk.pathsec.ALLOW_PROXIED_FETCH=True` for operators who trust their proxy.
Affected products
- NLTK Project NLTK <= 3.10.2
Timeline
- 2026-08-11: disclosed
- 2026-09-08: advisory
- 2026-09-08: patched: Patched in version 3.10.3