NLTK Symlink Following Vulnerability in nltk.sem.chat80.sql_query

Executive Summary

CVE-2026-126302 is a symlink following vulnerability in NLTK versions 3.9.4 to 3.10.3. It affects the nltk.sem.chat80.sql_query() function which bypasses the pathsec data-root sandbox containment check. Attackers with write access to a trusted NLTK data root can create a symbolic link to read SQLite databases outside the sandbox.

Useful 0 Not Useful 0

Detection Guidance

Check NLTK version with pip show nltk. If version is between 3.9.4 and 3.10.3, the system is vulnerable. Inspect directories listed in nltk.data.path for suspicious symlinks pointing outside the data root. Use find /path/to/nltk/data -type l -ls to detect symlinks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to read sensitive SQLite databases outside the intended sandboxed directory by exploiting symlinks. If you use NLTK versions 3.9.4 to 3.10.3 and an attacker can write to your NLTK data root, they may access confidential data stored in external databases.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using affected NLTK versions may face compliance risks if attackers exploit this to access protected health or personal data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to version 3.10.4 or later immediately. Remove write access to NLTK data root directories for untrusted users. Monitor for unusual database access patterns in application logs.

Useful 0 Not Useful 0