Path Traversal Vulnerability in NLTK Product by NLTK

CVE-2026-79676

What is CVE-2026-79676?

NLTK versions prior to 3.10.3 have a security flaw characterized by a path traversal vulnerability in its corpus readers. This vulnerability permits attackers to exploit the built-in open() function, which reopens paths derived from the root. As a result, malicious actors can create symlinked corpus files within a trusted data root, thereby gaining unauthorized access to content outside the designated root through standard corpus reader methods such as channels(), domains(), and synonyms(). Users of affected versions should take immediate action to secure their systems.

References