NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2
Priority HIGH 77CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 4 fixed, 5 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validation guard and are resolved to files outside the intended corpus root when accessed via frame_by_name(), _lu_file(), or doc() methods.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00651 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial nltk (nltk): 3.10.2nltk (PyPI): 3.10.2Red Hat: 5 advisoriesRed Hat: 4 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nltk | nltk | 3.10.0 to before 3.10.2 | 3.10.2 | Patch available | CNA |
| — | nltk (PyPI) | 3.10.0 to before 3.10.2 | 3.10.2 | Patch available | GHSA-f833-7jw8-xwrv |
- nltk Vendornltk Affected 3.10.0 to before 3.10.2 Fixed in 3.10.2 Patch available CNA
- nltk (PyPI) Vendor— Affected 3.10.0 to before 3.10.2 Fixed in 3.10.2 Patch available GHSA-f833-7jw8-xwrv
Remediation
- Fix · CNA nltk (nltk) Fixed in 3.10.2
- Fix · GHSA-f833-7jw8-xwrv nltk (PyPI) Fixed in 3.10.2 Advisory →
Red Hat 5 advisories
- RHSA-2026:87410 Released 2026-10-21 · Red Hat rating CriticalRHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
- RHSA-2026:86891 Released 2026-10-21 · Red Hat rating CriticalRHOAI 3.5.2 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
Show 2 more Red Hat advisories
- RHSA-2026:73987 Released 2026-09-30 · Red Hat rating CriticalRHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
- RHSA-2026:69539 Released 2026-09-21 · Red Hat rating ImportantRHOAI 3.5.1 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-mlserver-cuda-rhel9, registry.redhat.io/rhoai/odh-mlserver-rhel9 +28
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
nltk 3.10.2
2 records Highest priority Priority HIGH 1 HIGH, 1 LOW
Other records, highest priority first
- TI-2026-44523 nltk IPIPANCorpusReader Symlink Arbitrary File ReadPriority LOW 29
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix planned: Will not fix |
| Lightspeed Core | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:87410 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:73987 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734 |
| Red Hat OpenShift AI 3.5 | Fixed | RHSA-2026:69539, RHSA-2026:86891 |
Not affected: 5 products
- OpenShift Lightspeed
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift AI 3.5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-62384
- 2026-10-03 Alias added: GHSA-f833-7jw8-xwrv
- 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
- 2026-10-14 EPSS moved to the 50th–90th percentile
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
- 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat
References
More Nltk vulnerabilities
- TI-2026-00629 Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading CVSS 3.0CRITICAL 10.0
- TI-2025-12800 Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution CVSS 3.0CRITICAL 10.0
- TI-2026-55173 NLTK before 3.10.3 JVM Argument Injection via Per-Call Options CVSS 4.0CRITICAL 9.3
- TI-2026-55155 NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization CVSS 4.0CRITICAL 9.3
- TI-2026-56370 nltk PorterStemmer before 3.10.3 Quadratic-time DoS CVSS 4.0HIGH 8.7
- TI-2026-55172 NLTK 3.10.2 Path Traversal via corpus-reader constructors CVSS 4.0HIGH 8.8
Sources
- CVE-2026-62384 · CVE Program
- CVE-2026-62384 · NVD
- FIRST EPSS
- GHSA-f833-7jw8-xwrv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-62384 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences