CVE-2026-81726: NLTK model-artifact APIs sandbox bypass via path traversal

CVE-2026-81726 · Severity: high · CVSS 7 · Published 2026-08-27

NLTK is a natural language processing library that includes optional sandboxing mechanisms (pathsec) to restrict file access to approved directories when processing untrusted model files. Several model loading and saving APIs bypass these protections by using standard Python file operations instead of the security-aware helpers, allowing attackers to read or write arbitrary files outside the sandbox if an application permits user-controlled model paths.

Technologies: nltk (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-81726 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-81726 being exploited in the wild.
How severe is CVE-2026-81726?
High severity, with a CVSS score of 7, published 27 August 2026.
Which products and versions are affected?
nltk (PyPI) <= 3.10.3, ECOSYSTEM:introduced=0,fixed=3.10.3, ECOSYSTEM:introduced=0,last_affected=3.10.3.
Is there a fix for CVE-2026-81726?
Yes. nltk (PyPI): upgrade to 3.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81726 attacked?
It is attacked over the network.
Am I affected by CVE-2026-81726?
Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nltk (PyPI): upgrade to 3.10.3 or later
    pip install "nltk>=3.10.3"

Technical details

This is a file sandbox bypass (CWE-22, CWE-59, CWE-73) affecting NLTK's model persistence APIs. The vulnerable components—TransitionParser.train(), TransitionParser.parse(), AveragedPerceptron.save(), AveragedPerceptron.load(), PerceptronTagger.save_to_json(), and save_maxent_params()—directly call Python's built-in open() on caller-supplied model paths, bypassing the pathsec.open() guard that enforces root directory restrictions. Exploitation requires an application to enable pathsec enforcement (pathsec.ENFORCE=True) and allow untrusted code to specify model import/export paths; the attacker can then supply paths with directory traversal sequences (e.g., "../../../etc/passwd") to access or modify files outside the sandbox. PoC evidence shows successful out-of-root reads and writes via these APIs while identical paths are correctly rejected by guarded sibling functions. No patches are currently available; remediation involves routing all model-path file access through nltk.pathsec.open() or existing pathsec-aware helpers.

Affected products

  • NLTK Project NLTK 3.9.4 through 3.10.3

Identifiers

  • CVE-2026-81726
  • GHSA-8mgp-746c-j5xp
  • PYSEC-2026-3740

Timeline

  • 2026-08-12: disclosed
  • 2026-09-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.