CVE-2026-79676

Several NLTK corpus readers (IPIPAN, Crubadan, and Lin) reopen corpus files derived from trusted roots using Python's built-in open() instead of nltk.pathsec.open(), so symlinks placed inside a trusted corpus root are followed to files outside that root even when pathsec.ENFORCE=True is enabled. An attacker who can stage files or symlinks in a trusted NLTK data directory — for example in shared or multi-tenant environments that process untrusted or attacker-influenced corpora — can have outside-root content parsed and returned through normal public methods such as channels(), domains(), langs(), crubadan_to_iso(), and synonyms(). This is a path-traversal and symlink-following flaw (CWE-22/CWE-59) that defeats the trusted-root boundary pathsec is meant to enforce, with high confidentiality impact but no integrity or availability impact. Published NLTK 3.9.4 and the current v3.10.0-rc2 source are both affected, and no patched release is available yet. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known; EPSS estimates about a 0.3% probability of exploitation within 30 days (CVSS 4.0: 8.2 High).

What to do: No patched NLTK release exists yet, so monitor the nltk/nltk repository for a fix covering the ipipan, crubadan, and lin readers. Until a fix ships, prevent symlinks inside trusted NLTK data roots (replace links with real files, or restrict write access to those directories), especially where pathsec.ENFORCE=True guards shared or untrusted corpora. Audit any deployment that relies on pathsec trusted-root boundaries, since parsed outside-root content can already be returned through normal reader APIs.