Arbitrary File Read Vulnerability in NLTK by NLTK Project

CVE-2026-0846

What is CVE-2026-0846?

The filestring() function within the nltk.util module of NLTK version 3.9.2 is susceptible to an arbitrary file read vulnerability due to inadequate input path validation. This flaw allows attackers to leverage the function to open files specified by user input without any sanitization, potentially leading to unauthorized access of sensitive system files. This vulnerability poses risks in both local and remote exploitation scenarios, especially in environments utilizing web APIs or interfaces that process user-supplied input.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References