Executive brief
NLTK's corpus readers provide tools for linguists and developers to load and parse language datasets. Several corpus reader components were bypassing the library's symlink-aware access control, allowing malicious symlinks placed inside trusted corpus directories to read sensitive files from outside those directories. This defeats NLTK's documented security boundary in shared and untrusted-input environments.
Technical details
The vulnerability is a path traversal and symlink boundary bypass in NLTK's corpus readers (ipipan, crubadan, lin, and others). The root cause is that corpus readers derive paths from trusted corpus state as PathPointer objects, convert them back to plain strings, and then reopen them using the built-in Python open() function instead of nltk.pathsec.open(). This bypasses the trusted-root validation that pathsec enforces. Under pathsec.ENFORCE=True, a symlink placed inside an allowlisted corpus root can target outside-root files, and the reader will successfully parse and return the external content through public methods like channels(), domains(), categories(), and synonyms(). The attack requires the attacker to control corpus files or symlinks within a trusted data root directory. A fix in version 3.10.3 replaces direct open() calls with nltk.pathsec.validate_path() before file access, preserving the required_root boundary. The fix blocks symlink escapes but does not prevent hardlink attacks or validate-then-open TOCTOU races.
Affected products
- NLTK Project NLTK <= 3.10.2
Timeline
- 2026-09-08: disclosed: Advisory published
- 2026-09-08: patched: Fixed in version 3.10.3