Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-62388

NLTK before 3.10.0 Insecure Default Configuration in pathsec.py

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nltk nltk

Default version status: unaffected

  • 0 to < 3.10.0affected
  • 3.10.0unaffected
pkg:pypi/nltk

References