Gptline: NLTK: Default ENFORCE=False Disables All pathsec Security Controls (CVE-2026-62388)

The NLTK library's pathsec.py module, introduced to mitigate arbitrary code execution and path traversal vulnerabilities (CVE-2024-39705 and CVE-2026-0846), defaults its ENFORCE flag to False. This means that instead of raising exceptions on security violations, the module only emits RuntimeWarnings, allowing potentially unsafe operations such as reading sensitive files or loading untrusted pickle data to succeed. The security controls are effectively opt-in rather than opt-out, undermining their purpose. Users must explicitly set the environment variable NLTK_PATHSEC_ENFORCE=1 to enable enforcement. The suggested remediation is to change the default to ENFORCE=True, making the security checks fail-secure by default.

Because the security enforcement is disabled by default, users of NLTK versions prior to 3.10.0 who rely on the pathsec module for protection remain vulnerable to arbitrary file reads, unsafe pickle deserialization, and path traversal attacks. This undermines the fixes for CVE-2024-39705 and CVE-2026-0846, potentially allowing attackers to bypass security controls without triggering exceptions, only warnings. This can lead to unauthorized data access and code execution risks if unsafe data sources are used.

A patch is available to change the default behavior of the pathsec module to ENFORCE=True, enabling security enforcement by default. Users should apply this patch or upgrade to a fixed version where enforcement is enabled by default. Until then, users can manually enable enforcement by setting the environment variable NLTK_PATHSEC_ENFORCE=1 to activate security exceptions. This ensures that violations raise exceptions rather than just warnings, restoring the intended security protections.