Executive brief
NLTK is a natural language processing library that includes optional sandboxing mechanisms (pathsec) to restrict file access to approved directories when processing untrusted model files. Several model loading and saving APIs bypass these protections by using standard Python file operations instead of the security-aware helpers, allowing attackers to read or write arbitrary files outside the sandbox if an application permits user-controlled model paths.
Technical details
This is a file sandbox bypass (CWE-22, CWE-59, CWE-73) affecting NLTK's model persistence APIs. The vulnerable components—TransitionParser.train(), TransitionParser.parse(), AveragedPerceptron.save(), AveragedPerceptron.load(), PerceptronTagger.save_to_json(), and save_maxent_params()—directly call Python's built-in open() on caller-supplied model paths, bypassing the pathsec.open() guard that enforces root directory restrictions. Exploitation requires an application to enable pathsec enforcement (pathsec.ENFORCE=True) and allow untrusted code to specify model import/export paths; the attacker can then supply paths with directory traversal sequences (e.g., "../../../etc/passwd") to access or modify files outside the sandbox. PoC evidence shows successful out-of-root reads and writes via these APIs while identical paths are correctly rejected by guarded sibling functions. No patches are currently available; remediation involves routing all model-path file access through nltk.pathsec.open() or existing pathsec-aware helpers.
Affected products
- NLTK Project NLTK 3.9.4 through 3.10.3
Timeline
- 2026-08-12: disclosed
- 2026-09-02: advisory