Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: nltk 3.9.4 Clear all filters
TI-2026-49337 CVE-2026-70626 · GHSA-r6gq-whwq-mvg9

NLTK before 3.9.4 Symlink Escape via CorpusReader

Priority HIGH 70

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root.

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.002 Published 2026-08-22 Fixed in 3.9.4 CWE-59
TI-2026-47152 CVE-2026-66393 · GHSA-rf74-v2fm-23pw

NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder

Priority HIGH 77

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00521 Published 2026-08-22 Partial fix · 3.9.4 CWE-674