Executive brief
NLTK is a natural language processing library that includes a path security (pathsec) mechanism to confine file access to approved sandbox directories. However, model loading and saving APIs for several components (TransitionParser, AveragedPerceptron, PerceptronTagger) bypass this enforcement and use raw file operations, allowing attackers to read sensitive files or write malicious files anywhere on the system if an application trusts user-supplied model paths.
Technical details
The vulnerability is a sandbox bypass (CWE-73: External Control of File Name or Path) in NLTK's model persistence APIs. Root cause: TransitionParser.train(), TransitionParser.parse(), AveragedPerceptron.save(), AveragedPerceptron.load(), PerceptronTagger.save_to_json(), and save_maxent_params() use built-in Python open() instead of nltk.pathsec.open() for file access, even when pathsec.ENFORCE=True is set. Sibling functions like PerceptronTagger.load_from_json() and load_maxent_params() correctly use pathsec-aware helpers and reject outside-root paths. Attack preconditions: the application must enable pathsec enforcement and allow untrusted workflows to specify model paths. An attacker can then supply a path with traversal sequences (e.g., ../../../etc/passwd) that bypass the sandbox. Impact: read/write of arbitrary files. No patch is currently available.
Affected products
- NLTK Project NLTK <= 3.10.3
Timeline
- 2026-08-27: disclosed: Published by GHSA-hqj7-phwp-c3fp and associated with CVE-2026-81726
- 2026-08-27: advisory: Original advisory published
- 2026-09-02: other: GHSA-hqj7-phwp-c3fp marked as duplicate and withdrawn in favor of GHSA-8mgp-746c-j5xp