The vulnerability in NLTK (Natural Language Toolkit) affects the corpus-reader constructors, notably LinThesaurusCorpusReader and PanLexLiteCorpusReader, which can bypass the path sandbox enforced by nltk.pathsec. Although pathsec.open() blocks unauthorized file access, these corpus readers use builtin open() and sqlite3.connect() on paths derived from the root without sandbox validation. This allows them to read files or databases outside the sandbox root directory, violating the intended sandbox boundary. The issue is present in version 3.10.2 (commit 474af1f5a94b1b8d53fc2b6defec3a2ce7633b74) and was verified on Python 3.13.14. The root cause is that CorpusReader.__init__ converts the root string to a FileSystemPathPointer without pathsec validation, and the readers then access files/databases directly, bypassing sandbox enforcement.

An attacker or user able to supply a corpus root path to these NLTK corpus readers can cause the application to read files or databases outside the intended sandbox directory. This could lead to unauthorized information disclosure if sensitive files or databases are accessible. No privileges beyond supplying the root path are required. The impact is limited to file and database read access outside the sandbox boundary.

A patch is available for this vulnerability. Users should update NLTK to a fixed version where CorpusReader constructors enforce pathsec sandbox validation on the root path and avoid direct builtin open() or sqlite3.connect() calls on unvalidated paths. Until patched, avoid using LinThesaurusCorpusReader and PanLexLiteCorpusReader with untrusted root paths.