EUVD-2026-64338
GHSA-qq3h-cgj8-w3fx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Placing a symlink requires local write access to the corpus directory, so AV:L and PR:L; no integrity or availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validation guard and are resolved to files outside the intended corpus root when accessed via frame_by_name(), _lu_file(), or doc() methods.
AnalysisAI
Symlink-based path traversal in NLTK's FramenetCorpusReader before version 3.10.2 permits attackers with write access to a corpus subdirectory to read arbitrary XML files outside the intended corpus root. The flaw exists because path validation in frame_by_name(), _lu_file(), and doc() checks only for path separator characters in filenames but does not resolve symbolic links before access, allowing a separator-free symlink name to bypass the guard and dereference an out-of-root target. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has write access to an NLTK FrameNet corpus subdirectory on the target host - a condition present in shared research environments, world-writable corpus installations, or pipelines where multiple user accounts share a corpus directory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.7) materially overstates network accessibility: creating a filesystem symlink requires local write access to the corpus directory, making this a local-privilege information-disclosure flaw rather than an unauthenticated remote attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a shared university NLP compute cluster where the FrameNet corpus directory is group-writable, a non-privileged researcher creates a symlink named 'attacker_frame' (no path separators) inside the corpus directory, pointing to a sensitive XML configuration file - such as a deployment config or credentials file - outside the corpus root. When an automated pipeline running under a more privileged service account subsequently calls frame_by_name('attacker_frame'), NLTK's path validation passes the separator-free name, the OS resolves the symlink at open-time, and the contents of the sensitive file are read as FrameNet corpus data and potentially surfaced to the attacker. … |
| Remediation | Upgrade NLTK to version 3.10.2 or later, as confirmed by the vendor advisory at https://github.com/nltk/nltk/security/advisories/GHSA-f833-7jw8-xwrv, which resolves the symlink bypass by ensuring symbolic links are resolved and validated against the corpus root before file access proceeds. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems using NLTK and determine current versions deployed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary code execution in the NLTK (Natural Language Toolkit) Python library affects all versions through its data dow
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research a
nltk is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is r
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a .
Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a vic
Argument injection in the Natural Language Toolkit (NLTK) Python library before 3.10.3 allows attackers who control the
Arbitrary code injection in the Natural Language Toolkit (NLTK) before 3.9.3 stems from the downloader module extracting
Arbitrary code execution in the Natural Language Toolkit (NLTK) before 3.10.3 allows attackers to bypass the library's p
Remote code execution in NLTK's TransitionParser component allows arbitrary OS command execution when a victim loads a c
StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() direc
Path traversal in NLTK before 3.10.3 exposes arbitrary filesystem content and SQLite databases by bypassing the library'
Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today