What is the CVSS score of CVE-2026-0846?

CVE-2026-0846 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Nltk are affected by CVE-2026-0846?

A high-severity vulnerability in the NLTK library (version 3.9.2) enables attackers to read arbitrary files from affected systems, potentially exposing sensitive data including credentials,…. A patch is available.

How to fix or mitigate CVE-2026-0846?

Within 24 hours: Identify all systems and applications using NLTK 3.9.2 and assess exposure; document findings in your vulnerability management system and notify relevant application owners. Within 7 days: Implement compensating controls (disable filestring() function if unused, apply WAF rules to block suspicious file access patterns, restrict NLTK process permissions); evaluate upgrading to a patched version if available from vendor. Within 30 days: Complete upgrade to a patched NLTK version or confirmed safe alternative library; validate remediation through penetration testing of affected applications; conduct audit of file access logs for indicators of exploitation.

Nltk CVE-2026-0846

HIGH

Absolute Path Traversal (CWE-36)

2026-03-09 security@huntr.dev

GHSA-h8wq-7xc4-p3qx

Information Disclosure Nltk

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SUSE

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Red Hat

7.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 21:07 vuln.today

cvss_changed

CVSS changed

Apr 17, 2026 - 21:07 NVD

8.6 (HIGH) 7.5 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Mar 09, 2026 - 20:16 nvd

HIGH 8.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

7 pypi packages depend on nltk (7 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.9.3.

DescriptionNVD

A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.

AnalysisAI

Unsafe path handling in NLTK's filestring() function enables attackers to read arbitrary files on affected iOS and AI/ML systems through improper input validation. An unauthenticated attacker can exploit this over the network by supplying directory traversal or absolute paths to access sensitive data, with particular risk in deployments exposing the function through web APIs. No patch is currently available for this high-severity vulnerability (CVSS 8.6).