CVE-2026-79676: NLTK corpus readers symlink boundary bypass

CVE-2026-79676 · Severity: high · CVSS 5.9 · Published 2026-08-25

NLTK's corpus readers provide tools for linguists and developers to load and parse language datasets. Several corpus reader components were bypassing the library's symlink-aware access control, allowing malicious symlinks placed inside trusted corpus directories to read sensitive files from outside those directories. This defeats NLTK's documented security boundary in shared and untrusted-input environments.

Technologies: nltk (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-79676 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-79676 being exploited in the wild.
How severe is CVE-2026-79676?
High severity, with a CVSS score of 5.9, published 25 August 2026.
Which products and versions are affected?
nltk (PyPI) <= 3.10.2, ECOSYSTEM:introduced=0,fixed=3.10.3.
Is there a fix for CVE-2026-79676?
Yes. nltk (PyPI): upgrade to 3.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79676 attacked?
It is attacked with local access.
Am I affected by CVE-2026-79676?
Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nltk (PyPI): upgrade to 3.10.3 or later
    pip install "nltk>=3.10.3"

Technical details

The vulnerability is a path traversal and symlink boundary bypass in NLTK's corpus readers (ipipan, crubadan, lin, and others). The root cause is that corpus readers derive paths from trusted corpus state as PathPointer objects, convert them back to plain strings, and then reopen them using the built-in Python open() function instead of nltk.pathsec.open(). This bypasses the trusted-root validation that pathsec enforces. Under pathsec.ENFORCE=True, a symlink placed inside an allowlisted corpus root can target outside-root files, and the reader will successfully parse and return the external content through public methods like channels(), domains(), categories(), and synonyms(). The attack requires the attacker to control corpus files or symlinks within a trusted data root directory. A fix in version 3.10.3 replaces direct open() calls with nltk.pathsec.validate_path() before file access, preserving the required_root boundary. The fix blocks symlink escapes but does not prevent hardlink attacks or validate-then-open TOCTOU races.

Affected products

  • NLTK Project NLTK <= 3.10.2

Identifiers

  • CVE-2026-79676
  • GHSA-p4rw-rvv2-7xwr
  • PYSEC-2026-3737

Timeline

  • 2026-09-08: disclosed: Advisory published
  • 2026-09-08: patched: Fixed in version 3.10.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.