Threats tagged 'brew-acronym-cve-2026-54293'

NLTK versions up to 3.9.4 with default configuration are vulnerable to a path traversal flaw in the nltk.data.load() function. The vulnerability arises because the security regex check is performed on the undecoded resource string, allowing URL-encoded traversal sequences to bypass the check and access arbitrary local files. This can lead to unauthorized local file reads, including sensitive files such as /etc/passwd or process environment variables.