Executive brief
NLTK is a natural language processing library commonly used in text analysis and NLP applications. The StreamBackedCorpusView component contains a security bypass that allows attackers to read arbitrary files from the system, even when NLTK's file access sandboxing (pathsec.ENFORCE) is enabled. An attacker who can control file paths passed to the vulnerable component can access sensitive system files, application credentials, and configuration data.
Technical details
The vulnerability exists in StreamBackedCorpusView._open() in nltk/corpus/reader/util.py, which bypasses the pathsec validation layer entirely by calling builtins.open() directly for string-based file paths instead of using nltk.pathsec.open(). The pathsec.ENFORCE security control is documented to sandbox all file access and raise PermissionError on unauthorized access, but StreamBackedCorpusView circumvents this by never calling pathsec.validate_path(). An attacker who can influence the fileid argument (e.g., via user input in a web application) can read any file on the system accessible to the NLTK process, including /etc/passwd and environment variables containing secrets. No privileges or user interaction are required. The vulnerability affects StreamBackedCorpusView, XMLCorpusView, and any corpus reader subclass that passes raw string fileids. A fix is available in NLTK 3.10.0, which replaces builtins.open() and os.stat() calls with pathsec-validated equivalents.
Affected products
- NLTK Project NLTK <= 3.9.4
Timeline
- 2026-08-22: disclosed
- 2026-08-07: patched: Fix available in NLTK 3.10.0
- 2026-08-22: advisory: Original GHSA-x5ph-mj9p-rfr8 published
- 2026-09-02: other: Duplicate advisory GHSA-8w48-h75v-cxpv withdrawn