VDB
CVE-2026-79674
CVE-2026-79674
PUBLISHED
CVSS 8.8 HIGH
Reported by VulnCheck · Published August 25, 2026
NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.
Risk Scores
CVSS 4.0
8.8
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| nltk | nltk | 0, 3.10.3 |
| PyPI | nltk | 0 |
| nltk | nltk | 3.10.3, 0, 0 |
Timeline
- Aug 25, 2026 Coalition ESS Score
- Aug 25, 2026 CVE Published
- Aug 26, 2026 EPSS Score
- Sep 1, 2026 EPSS Score
- Sep 2, 2026 Security Advisory
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Sep 30, 2026 EPSS Score
- Oct 2, 2026 EPSS Score
References
- GitHub Security Advisory (GHSA-3gq4-3j92-5w49) vendor-advisory
- VulnCheck Advisory: NLTK 3.10.2 Path Traversal via corpus-reader constructors third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-79674 advisory
- https://github.com/advisories/GHSA-3gq4-3j92-5w49 advisory
- https://github.com/nltk/nltk/commit/bc007200d123c1a98d74c2eb230f5e06c53886b8 patch
- https://github.com/nltk/nltk/releases/tag/v3.10.3 url
- https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3736.yaml advisory