CVE-2026-79676: NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement
Several corpus readers still step outside NLTK’s symlink-aware trusted-root model. They derive in-root paths from trusted corpus state, convert those paths back into plain strings, and reopen them with built-in open() rather than nltk.pathsec.open().
References
- github.com/advisories/GHSA-p4rw-rvv2-7xwr
- github.com/nltk/nltk/commit/10d34b3f4fe3fec74b76527a409eb0acbac2e8ab
- github.com/nltk/nltk/releases/tag/v3.10.3
- github.com/nltk/nltk/security/advisories/GHSA-p4rw-rvv2-7xwr
- github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3737.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-79676
- www.vulncheck.com/advisories/nltk-before-path-traversal-via-symlink-bypass
Code Behaviors & Features
Detect and mitigate CVE-2026-79676 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →