CVE-2026-63312

CVE-2026-63312 is a security-control bypass in the NLTK Python library: when operators set nltk.pathsec.ENFORCE = True to sandbox all file access to approved NLTK data directories, StreamBackedCorpusView._open() still calls builtins.open() and os.stat() directly on string paths, skipping pathsec.validate_path() entirely. An attacker who can influence the fileid argument passed to StreamBackedCorpusView — for example via a web app, REST API, or multi-tenant NLP pipeline that accepts user-supplied corpus paths — can read arbitrary local files such as /etc/passwd, /proc/self/environ (potentially leaking secrets like AWS_SECRET_ACCESS_KEY or DATABASE_URL), or application configuration files, despite the sandbox being enabled. XMLCorpusView and any corpus reader subclass that passes a raw string fileid to StreamBackedCorpusView are affected in the same way. The flaw requires no privileges or user interaction over a network path (CVSS 4.0: 8.7 High). No exploitation in the wild has been reported and it is not in CISA KEV; no public PoC is catalogued, and EPSS estimates a 0.6% probability of exploitation within 30 days (45th percentile).

What to do: Until a patched NLTK release is available, avoid passing user-controlled fileid strings to StreamBackedCorpusView or XMLCorpusView in ENFORCE-mode deployments, or pre-validate paths yourself (allow-list prefixes, reject absolute paths and traversal sequences) before invoking corpus readers. Treat pathsec.ENFORCE as bypassed: audit web/API handlers that feed user input into NLTK corpus readers and check for reads of /etc/passwd, /proc/self/environ, and config files in logs. When the upstream fix lands — routing StreamBackedCorpusView's builtins.open()/os.stat() calls through nltk.pathsec.open()/validate_path() — upgrade promptly and re-enable strict mode.