Logic Bug in NLTK Versions Allowing Arbitrary File Access

CVE-2026-65915

What is CVE-2026-65915?

Versions of NLTK earlier than 3.10.0 contain a logic bug in the FileSystemPathPointer.open() method. This issue arises during sandbox validation, where the path comparison is flawed, rendering the security check ineffective. By exploiting this vulnerability, attackers can supply specially crafted file:// URLs to the nltk.data.load() function, allowing them to access arbitrary files that the user process can read. This could lead to the exposure of sensitive information, including user credentials and configuration files, posing a significant risk to the integrity of the application.

References