CVE-2026-79674CWE-73

CVE-2026-79674

High · published August 25, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
31.6
In the wild
Unconfirmed
What it is

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00387 · 31.6th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2026-08-25T20:17Z
Affected products (1)
ProductVersionsFixed in
nltk/nltk< 3.10.33.10.3
References (3)
https://github.com/nltk/nltk/security/advisories/GHSA-3gq4-3j92-5w49 · [email protected]https://www.vulncheck.com/advisories/nltk-path-traversal-via-corpus-reader-constructors · [email protected]https://github.com/nltk/nltk/security/advisories/GHSA-3gq4-3j92-5w49 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 06:46Z
    EPSS moved — → 0%
    epss
  • 25 AUG 15:16Z
    NLTK 3.10.2 Path Traversal via corpus-reader constructors
    cvelistv5