Threats tagged 'brew-acronym-cve-2026-79676'

NLTK corpus readers ipipan, crubadan, and lin improperly handle symlinks inside trusted corpus roots, allowing path traversal outside the intended root. This occurs because they reopen root-derived paths using Python's built-in open() instead of the symlink-aware nltk.pathsec.open(), bypassing pathsec enforcement. An attacker able to place symlinks inside a trusted corpus root can cause the readers to disclose content from outside the root through normal corpus-reader methods. The issue affects versions 2.0.0 up to but not including 2.0.0_5 and is patched in 2.0.0_5. The vulnerability has a high CVSS 4.0 score of 8.2. Remediation involves replacing raw open() calls with nltk.pathsec.open() and validating paths with required_root scoping to enforce trusted-root boundaries.