CVE-2026-81727: NLTK: Downloader.download follows hardlinks and overwrites outside-root files
NLTK’s downloader now blocks symlink escapes during ZIP extraction, but it still treats pre-existing hardlinks inside the install tree as ordinary in-root files. A normal package install can therefore overwrite an outside-root inode through that hardlink.
References
- github.com/advisories/GHSA-f794-5jv7-7672
- github.com/nltk/nltk/commit/9e6d5f05902b9aaa1221a0a565448d17a9c9b3e8
- github.com/nltk/nltk/pull/3797
- github.com/nltk/nltk/releases/tag/v3.10.3
- github.com/nltk/nltk/security/advisories/GHSA-f794-5jv7-7672
- github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3741.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-81727
- www.vulncheck.com/advisories/nltk-before-3.10.3-hardlink-file-overwrite-via-downloader
Code Behaviors & Features
Detect and mitigate CVE-2026-81727 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →