Read the docs
TI-2026-46953 Aliases CVE-2026-65915GHSA-72r2-7mfr-5xr9

NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer

Priority MEDIUM 64CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.

Summary

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0041 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial nltk (nltk): 3.10.0nltk (PyPI): 3.10.0Red Hat: 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nltknltkbefore 3.10.03.10.0Patch availableCNA
—nltk (PyPI)before 3.10.03.10.0Patch availableGHSA-72r2-7mfr-5xr9
  • nltk Vendornltk Affected before 3.10.0 Fixed in 3.10.0 Patch available CNA
  • nltk (PyPI) Vendor— Affected before 3.10.0 Fixed in 3.10.0 Patch available GHSA-72r2-7mfr-5xr9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*before 3.10.0Vulnerablenltk
  • cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:* Versions before 3.10.0 Vulnerable ·nltk

Remediation

  • Fix · CNA nltk (nltk) Fixed in 3.10.0
  • Fix · GHSA-72r2-7mfr-5xr9 nltk (PyPI) Fixed in 3.10.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    nltk 3.10.0

    5 records Highest priority Priority HIGH 3 HIGH, 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-45157 NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File ReadPriority HIGH 77
    • TI-2026-44528 NLTK before 3.10.0 Insecure Default Configuration in pathsec.pyPriority HIGH 77
    • TI-2026-44525 NLTK 3.9.4 Path Traversal via FrameNet and NKJP ReadersPriority HIGH 69
    Show all 5 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet: Fix deferred
Lightspeed CoreAffectedNo fix yet: Fix deferred
OpenShift LightspeedAffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Not affected: 1 product
  • OpenShift Lightspeed

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-65915
  2. 2026-10-03 Alias added: GHSA-72r2-7mfr-5xr9

References

Exploit 1

Advisory 1

Other 5

  • TI-2026-00629 Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading CVSS 3.0CRITICAL 10.0
  • TI-2025-12800 Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution CVSS 3.0CRITICAL 10.0
  • TI-2026-55173 NLTK before 3.10.3 JVM Argument Injection via Per-Call Options CVSS 4.0CRITICAL 9.3
  • TI-2026-55155 NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization CVSS 4.0CRITICAL 9.3
  • TI-2026-56370 nltk PorterStemmer before 3.10.3 Quadratic-time DoS CVSS 4.0HIGH 8.7
  • TI-2026-55172 NLTK 3.10.2 Path Traversal via corpus-reader constructors CVSS 4.0HIGH 8.8
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences