Arbitrary Local File Read in NLTK StreamBackedCorpusView by NLTK

CVE-2026-63312

What is CVE-2026-63312?

The NLTK library, specifically the StreamBackedCorpusView component, has a vulnerability that allows attackers to read arbitrary local files by manipulating the fileid argument. This occurs because the component directly calls builtins.open() instead of enforcing file access restrictions through pathsec.open(). As a result, sensitive information, including system files and application credentials, can be compromised, leading to potential exposure of confidential data.

References