Threats tagged 'ghsa-fg9w-wfp5-j933'

NLTK's BllipParser component in versions 3.10.0 through before 3.10.4 allows an attacker to supply arbitrary filesystem paths to its native C extension without validation. This bypasses NLTK's usual path security checks, enabling reading of arbitrary files outside the intended data directories. The flaw can lead to disclosure of sensitive local files or denial of service by causing the parser to read oversized or special files. A fix is available in version 3.10.4.