Executive brief
NLTK is a widely-used Python library for natural language processing that loads language models and datasets via the `nltk.data.load()` function. An attacker can bypass path validation by using percent-encoded directory traversal sequences (like `..%2f`) to read arbitrary files on the system accessible to the Python process, potentially exposing sensitive configuration files, credentials, or application data. This vulnerability affects NLP applications, Jupyter notebooks, and CLI tools that rely on NLTK's resource loading.
Technical details
This is a path traversal vulnerability (CWE-22) in NLTK's resource loading mechanism. The `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.py` validates resource names to prevent directory traversal by checking for literal `../` sequences, but the subsequent `url2pathname()` function decodes percent-encoded sequences after validation, allowing sequences like `..%2f` to bypass the check. An attacker who controls the resource name parameter in `nltk.data.load()` or `nltk.data.find()` can construct a path that decodes to a traversal sequence, enabling arbitrary file reads. The default `pathsec.ENFORCE=False` setting fails to block the file read at the `open()` stage, exacerbating the impact. Network-based attack is possible if the application exposes resource loading functionality via a web interface. The vulnerability affects NLTK versions prior to 3.10.0; patch status in the primary advisory (GHSA-m42h-3232-vpv3) should be consulted for fix details.
Affected products
- NLTK Project NLTK < 3.10.0
Timeline
- 2026-06-30: disclosed: Advisory published to GitHub Advisory Database
- 2026-08-13: other: Advisory withdrawn as duplicate of GHSA-m42h-3232-vpv3