In NLTK versions before 3.10.0, the pathsec.py module defaults the ENFORCE setting to False. This causes security validation functions to only emit warnings rather than raising exceptions when validation fails. As a result, protections against path traversal and pickle deserialization attacks can be bypassed if the security controls are not manually enabled. This vulnerability is tracked as CVE-2026-62388 with a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating a high severity remote vulnerability that can lead to confidentiality impact without requiring privileges or user interaction.

Attackers can bypass path traversal and pickle deserialization protections in affected NLTK versions by exploiting the disabled security controls that only activate when ENFORCE is manually set to True. This can lead to unauthorized access to sensitive data or execution of malicious deserialization payloads, impacting confidentiality. There is no indication of integrity or availability impact. The vulnerability is remotely exploitable without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should manually enable the ENFORCE setting in pathsec.py to ensure security validation functions raise exceptions rather than just warnings, thereby restoring protections against path traversal and pickle deserialization attacks.