NLTK CVE-2026-81726

Exploitation is contingent on the target application having pathsec actively enabled - without pathsec, there is no security boundary to bypass and the behavior is consistent with intended operation. The attacker must be able to supply or influence the file path argument passed to one of the four affected APIs (TransitionParser, AveragedPerceptron, PerceptronTagger, or maxent parameter loading); if all model paths are operator-hardcoded, exploitation is not possible regardless of network access. Network-level reachability to a service exposing these APIs is required (AV:N). The CVSS AC:H and AT:P metrics indicate that the attack is not trivially reproducible against arbitrary deployments and requires a specific configuration intersection. Exploitation is further bounded by the OS-level permissions of the NLTK process - a containerized or low-privilege process limits what can be reached even if the pathsec bypass succeeds.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L) presents a nuanced risk picture. Network reachability with no required privileges (PR:N, UI:N) is the most alarming signal, but high attack complexity (AC:H) and specific attack prerequisites (AT:P) substantially constrain realistic exploitability - the AT:P metric directly reflects the requirement that pathsec must be deployed and active for the bypass to constitute a security violation. The dominant impact is high confidentiality loss (VC:H), with only minor integrity and availability consequences. No EPSS score was provided in source data, and neither a CISA KEV listing nor a public proof-of-concept has been identified, indicating no confirmed widespread or automated exploitation at this time. Real-world priority depends heavily on deployment pattern: applications that expose NLTK model-loading APIs to external or untrusted input face meaningful arbitrary file-read risk, while offline research or tightly sandboxed deployments are substantially lower priority. The pathsec prerequisite is a genuine limiting factor - environments not using pathsec as a security boundary are outside the intended threat model of this control bypass.

An attacker submits a crafted model path containing traversal sequences (e.g., '../../../../etc/passwd' or an absolute path) to a web application or ML inference endpoint that calls NLTK's PerceptronTagger or TransitionParser model-loading API with user-influenced input. Because these APIs bypass pathsec and perform raw file reads, the NLTK process reads the targeted file and returns or caches its contents, leaking sensitive configuration, credentials, or private data outside the intended sandbox root. No public proof-of-concept exploit has been identified, but the technique is well-understood and requires no specialized tooling beyond crafted path strings.