Gptline: NLTK: Stable FrameNet and NKJP readers parse outside-root XML (CVE-2026-62385)

The vulnerability in NLTK 3.9.4 affects several XML-reader entrypoints in FrameNet and NKJP corpus readers, including FramenetCorpusReader.frame_by_name, doc, lu, and NKJPCorpusReader.header. These readers construct parser paths from caller-controlled selectors or poisoned index state without enforcing corpus-root boundary confinement, enabling path traversal and trusted-root bypass. The flaw allows parsing of XML files located outside the trusted corpus root. The issue is confirmed by proof-of-concept tests and is fixed in NLTK 3.10.0, which rejects unsafe path components and enforces path-safety. The vulnerability has a CVSS 3.1 score of 5.9 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and impact on confidentiality only.

Applications using vulnerable NLTK versions (3.9.4) that accept attacker-influenced FrameNet or NKJP corpus selectors or index state can be tricked into parsing XML files outside the trusted corpus root. This can lead to unauthorized disclosure of file contents (confidentiality impact). There is no impact on integrity or availability. The vulnerability requires network access and has high attack complexity, with no privileges or user interaction needed.

A patch is available in NLTK version 3.10.0, which enforces path-safety by rejecting unsafe path components before constructing filenames from frame names, document filenames, LU ids, or NKJP file identifiers. Users should upgrade to version 3.10.0 or later to mitigate this vulnerability. Until upgraded, applications should avoid processing untrusted selectors or index state with the affected reader APIs.