NLTK CVE-2026-63312

Exploitation requires that the consuming application passes attacker-controlled or externally influenced values to the fileid argument of StreamBackedCorpusView without application-layer path validation or allowlisting. The bypass is unconditional at the library level for all NLTK versions before 3.10.0 - pathsec.ENFORCE configuration does not matter. Exploitation is therefore limited to deployments where user input reaches this parameter, such as web APIs, corpus browsers, or NLP pipelines that accept dynamic file identifiers from external sources. Authentication requirements are determined entirely by how the consuming application gates access to the vulnerable endpoint, not by NLTK itself; the CVSS 4.0 vector's PR:N reflects no privilege requirement at the library layer. Offline or batch NLTK usage with no external fileid exposure is not exploitable.

The CVSS 4.0 base score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N/VC:H reflects the high confidentiality impact assuming a network-accessible NLTK deployment where user input reaches the fileid argument - the official scoring treats no specific attack requirement as necessary. In practice, real-world exploitability is conditional on that specific application usage pattern: an NLP inference API, corpus browsing service, or text-processing pipeline that forwards user-supplied identifiers to StreamBackedCorpusView is directly at risk, while offline batch processing that never exposes fileid to external input is not. No active exploitation has been confirmed by CISA KEV, and no public POC code has been identified at time of analysis, reducing urgency compared to similarly scored vulnerabilities with confirmed in-the-wild exploitation. EPSS data was absent from the source intelligence; prioritization should weight deployment pattern specificity and whether applications in scope pass external input to fileid rather than relying on the raw score alone.

An attacker targeting a web service that accepts a corpus file identifier from user input and passes it to StreamBackedCorpusView submits a path such as /etc/passwd or an application secrets file. Because StreamBackedCorpusView calls builtins.open() directly, pathsec.ENFORCE is silently bypassed and the file contents are returned. No public exploit code has been identified at time of analysis, though the attack logic is mechanically straightforward given the explicit description of the bypass.