CVE-2026-62388CWE-1188

CVE-2026-62388

High · published August 22, 2026

CVSS v3.1

7.5

EPSS

Percentile

42.8

In the wild

Unconfirmed

What it is

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00512 · 42.8th percentile
Weakness: CWE-1188 · Initialization of a Resource with an Insecure Default
Published: 2026-08-22T19:16Z

Affected products (1)

Product	Versions	Fixed in
nltk/nltk	< 3.10.0	3.10.0

References (3)

https://github.com/nltk/nltk/security/advisories/GHSA-p3m8-78j2-g5p3 · [email protected]https://www.vulncheck.com/advisories/nltk-before-insecure-default-configuration-pathsec · [email protected]https://github.com/nltk/nltk/security/advisories/GHSA-p3m8-78j2-g5p3 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

22 AUG 14:12Z
NLTK before 3.10.0 Insecure Default Configuration pathsec
cvelistv5