CVE-2026-79674: NLTK: Corpus Reader Sandbox Bypass
NLTK corpus-reader constructors can still reach outside-root file and database reads before the nltk.pathsec sandbox boundary is enforced.
The PoC shows the safe path blocked by pathsec.open, then LinThesaurusCorpusReader and PanLexLiteCorpusReader succeeding in the same process.
References
- github.com/advisories/GHSA-3gq4-3j92-5w49
- github.com/nltk/nltk/commit/bc007200d123c1a98d74c2eb230f5e06c53886b8
- github.com/nltk/nltk/releases/tag/v3.10.3
- github.com/nltk/nltk/security/advisories/GHSA-3gq4-3j92-5w49
- github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3736.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-79674
- www.vulncheck.com/advisories/nltk-path-traversal-via-corpus-reader-constructors
Code Behaviors & Features
Detect and mitigate CVE-2026-79674 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →