NLTK CVE-2026-62388

Exploitation requires that the target NLTK application processes attacker-controlled file paths or serialized pickle data through pathsec.py validation functions, and that the application has not explicitly overridden the default ENFORCE=False by setting it to True. The host must be running NLTK prior to version 3.10.0. Limiting factors: applications that use NLTK solely for in-memory text processing tasks (tokenization, POS tagging, parsing) without loading external corpora or pickle files from untrusted sources are not exposed, as the vulnerable code path is only triggered when path or pickle validation functions are called on attacker-supplied input. The CVSS PR:N indicates no authentication is required at the NLTK library level; however, upstream application-layer authentication or network perimeter controls may restrict who can deliver malicious input to the affected functions.

The CVSS 4.0 base score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N reflects that network-accessible NLTK applications require no authentication and no special attack preconditions. However, the provided vector assigns only VC:H while scoring VI and VA as N - this appears to underweight the potential impact of unrestricted pickle deserialization, a primitive that enables arbitrary code execution and should typically yield I:H and A:H equivalents in most CVSS 3.1 assessments; defenders should independently verify this scoping decision, as it may reflect a narrow interpretation of the advisory scope. No EPSS score was provided and no POC or CISA KEV listing is present, leaving actual exploitation probability unconfirmed. The realistic danger scales with the volume of attacker-controlled data flowing through NLTK's path and deserialization functions - organizations running NLP pipelines that ingest external corpora or user-submitted documents should treat this as urgent, since the bypass requires zero additional attacker effort beyond reaching the library's validation layer. The insecure-by-default pattern is particularly dangerous because security teams reviewing NLTK documentation or source code might reasonably assume protections are active.

An attacker submits a crafted path traversal string (such as ../../etc/shadow) or a malicious pickle payload to a web service or data pipeline built on NLTK before 3.10.0. Because ENFORCE=False, pathsec.py logs a warning and continues processing, allowing the traversal to read sensitive files from the server filesystem or the pickle payload to deserialize and execute arbitrary attacker-controlled code in the server process. No public proof-of-concept has been identified at time of analysis, but the insecure default removes the primary defensive barrier with no additional attacker prerequisites beyond reaching the NLTK validation layer.