Executive brief
NLTK is a popular natural language processing library used by data scientists and developers to build text analysis applications. A logic bug in its file sandboxing mechanism allows attackers to read arbitrary files on the system—such as configuration files, credentials, and private keys—by crafting malicious URLs passed to the library's data loading functions. Any application that accepts user input for file paths is vulnerable.
Technical details
The vulnerability is a logic error (CWE-284: Improper Access Control) in the FileSystemPathPointer.open() method in nltk/data.py. The sandbox check compares os.path.normpath(self._path) against itself on consecutive lines, so the comparison is always equal and the ValueError guard never fires. Additionally, __init__() already calls os.path.abspath() during construction, making the re-normalization in open() redundant. An attacker can exploit this by passing file:// URLs to nltk.data.load() or nltk.data.find() functions to read any file accessible to the process user. The attack requires network-reachable vulnerable code and low privileges (user must be able to influence the data load path). NLTK 3.10.0 patches this issue by validating paths against the actual permitted data directories using os.path.commonpath().
Affected products
- NLTK Project NLTK <= 3.9.3
Timeline
- 2026-08-22: disclosed
- 2026-08-07: patched: Patch released in version 3.10.0