Threat Intelligence Database

CVE-2026-62384 is a symlink-based sandbox bypass vulnerability in the NLTK library's FramenetCorpusReader. It allows reading arbitrary XML files outside the intended corpus root by exploiting a flaw in path validation that does not resolve symlinks. This bypasses a previous fix for a related path traversal issue (CVE-2026-54292). The vulnerability affects certain file-reading methods that use a lexical path join without enforcing root directory constraints. A patch is available to route these calls through a safer, symlink-resolving validation method.

The RecursiveDescentParser and SteppingRecursiveDescentParser components in NLTK can be exploited by crafted ambiguous or left-recursive grammars to cause unbounded CPU consumption or stack exhaustion, resulting in denial of service. This affects applications that parse grammars or inputs from untrusted sources. There is no impact on confidentiality or integrity, only on availability of the affected process. A patch is available to address this issue.

NLTK's XMLCorpusView._read_xml_fragment() function exhibits quadratic CPU exhaustion when processing malformed XML corpus files. The function reads input in 1 KiB blocks, appending to a growing buffer and rescanning the entire accumulated fragment with a regex match on each iteration. This causes CPU usage to grow quadratically with input size, leading to potential denial of service. The issue affects several corpus readers relying on XMLCorpusView, including BNCCorpusReader. No patch is available in published releases, but a fix is suggested to avoid rescanning the entire buffer each iteration.

The NLTK TweetTokenizer in gptline is vulnerable to a denial of service caused by catastrophic regex backtracking in its URL matching regular expression. This flaw allows crafted input with many alternating label separators to cause exponential processing time, potentially stalling services that tokenize untrusted social media text. A fix bounding the label repetition was introduced in version 3.10.1.

NLTK versions before 3.10.3 contain a remote code execution vulnerability in the AllowlistUnpickler component. The vulnerability arises because the validation only checks the pickle module string but not the full global name, allowing attackers to exploit attribute traversal to invoke callables outside the intended allowlist. This can be triggered by crafting malicious transition-parser models that execute arbitrary commands when loaded via TransitionParser.parse.

NLTK versions 3.9.4 through 3.10.2 contain a path traversal vulnerability in the CrubadanCorpusReader component. This flaw allows an attacker controlling a corpus package to disclose arbitrary files outside the intended corpus directory by exploiting improper path handling in the _load_lang_ngrams function. The vulnerability is limited to files ending with '-3grams.txt' that parse as token count lines. The CVSS score is low, reflecting limited impact and difficult exploitation conditions.

NLTK's corpus-reader constructors, specifically LinThesaurusCorpusReader and PanLexLiteCorpusReader, can bypass the nltk.pathsec sandbox designed to restrict file and database access. This allows these readers to perform file and database reads outside the intended sandbox root even when sandbox enforcement is enabled. The vulnerability arises because the CorpusReader.__init__ method converts the root path to a FileSystemPathPointer without applying pathsec validation, and subsequent file/database operations use builtin open() or sqlite3.connect() directly, bypassing sandbox controls.

Several corpus readers in NLTK (Natural Language Toolkit) improperly handle symlinked files, allowing path traversal and symlink boundary bypass. These readers reopen paths derived from trusted roots using raw open() calls instead of the symlink-aware nltk.pathsec.open(), enabling attackers to disclose files outside the trusted corpus root. The issue affects specific readers such as ipipan, crubadan, and lin in versions 3.9.4 and 3.10.0-rc2. A fix is available that enforces path validation and trusted-root boundaries end to end.

NLTK's Text.findall() and TokenSearcher.findall() methods in the nltk.text module accept user-supplied regular expressions without validation or timeout, leading to a Regular Expression Denial of Service (ReDoS) vulnerability. This allows an unauthenticated attacker to cause indefinite CPU saturation by exploiting catastrophic backtracking in the regex engine. The issue was fixed in a prior commit.

The NLTK tgrep module suffers from a Regular Expression Denial of Service (ReDoS) vulnerability due to unvalidated user-supplied regex patterns compiled without timeout. This allows an attacker to cause catastrophic backtracking, leading to indefinite CPU consumption and denial of service in applications exposing the tgrep API to external input. The vulnerability affects NLTK versions up to 3.10.2 and has been confirmed with proof-of-concept code demonstrating exponential runtime growth. A patch is available to mitigate this issue.