Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.2, published 25 August 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-08-11: NLTK 3.10.3 and later contain the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

NLTK corpus reader sandbox bypass

Severity: high · CVSS 8.2 · Published 2026-08-25

NLTK is a widely-used Python natural language processing library that includes sandbox protection (pathsec) to restrict file access to designated data directories. A vulnerability in corpus reader constructors allows attackers to bypass this sandbox and read arbitrary files and SQLite databases from anywhere on the filesystem by supplying a malicious corpus root path. An application using NLTK could expose sensitive configuration files, source code, or other confidential data on the server.

Technologies: nltk (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.2, published 25 August 2026.
Which products and versions are affected?: nltk (PyPI) <= 3.10.2.
Is there a fix for This vulnerability?: A patch was published on 2026-08-11: NLTK 3.10.3 and later contain the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal / external control of file path (CWE-73) in NLTK's CorpusReader, LinThesaurusCorpusReader, and PanLexLiteCorpusReader constructors. The root cause is that CorpusReader.__init__() converts a user-supplied string root into a FileSystemPathPointer without validating it against the pathsec sandbox, then uses builtin open() and sqlite3.connect() directly on derived paths. This bypasses the pathsec.open() guard that would normally enforce the data-root boundary. An attacker with the ability to control the corpus root path argument to these constructors (a common pattern in applications consuming untrusted corpus specifications) can read any file or database on the system. No special privileges are required; the attack is network-reachable if the vulnerable reader constructors are exposed via a web service or similar. The fix is to validate and route all corpus-root handling through pathsec before file operations. Patched versions are available in NLTK 3.10.3 and later.

Affected products

NLTK NLTK < 3.10.3

Timeline

2026-08-25: disclosed
2026-08-11: patched: NLTK 3.10.3 and later contain the fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.