Insecure Default Configuration in NLTK Affects Python Libraries

CVE-2026-62388

What is CVE-2026-62388?

The NLTK library versions prior to 3.10.0 are configured with an insecure default that sets ENFORCE to False in pathsec.py. As a result, security validation functions emit warnings instead of raising exceptions. This flaw allows attackers to exploit the bypassed security measures related to path traversal and pickle deserialization by taking advantage of disabled security controls, which require manual enabling for proper operation.

References