CVE-2026-62384: NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)
The original advisory was fixed (PR #3581) by adding _reject_unsafe_path_component(), which blocks literal /, \, .., and Windows drive prefixes in caller-/corpus-supplied names. It never resolves symlinks. All three call sites that use this guard still resolve the resulting path through self.abspath() (nltk/corpus/reader/api.py, self._root.join(fileid)), which is a plain lexical join, not the symlink-resolving, required_root-scoped check that CorpusReader.open() (and NKJPCorpusReader’s own fix for its sibling advisory) correctly use elsewhere in this same codebase.
A symlink placed inside the corpus’s own subdirectory, with a name containing no separators at all, passes the guard cleanly and reads a file completely outside the corpus root.
References
- github.com/advisories/GHSA-f833-7jw8-xwrv
- github.com/nltk/nltk/commit/736d3212a47de2005b85b785dde6720556d3925d
- github.com/nltk/nltk/pull/3726
- github.com/nltk/nltk/releases/tag/v3.10.2
- github.com/nltk/nltk/security/advisories/GHSA-f833-7jw8-xwrv
- github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3789.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-62384
- www.vulncheck.com/advisories/nltk-framenetcorpusreader-symlink-sandbox-bypass-before
Code Behaviors & Features
Detect and mitigate CVE-2026-62384 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →