Threats tagged 'brew-acronym-cve-2026-62384'

CVE-2026-62384 is a vulnerability in the NLTK FramenetCorpusReader that allows a symlink-based sandbox bypass. It circumvents the prior fix for CVE-2026-54292 by exploiting the fact that the path validation does not resolve symlinks. An attacker can place a symlink inside the corpus directory pointing to an arbitrary file outside the corpus root, which is then read without restriction by certain API calls. This allows reading arbitrary XML files outside the intended corpus directory without triggering exceptions or requiring special user interaction.