NLTK Symlink Escape Vulnerability in YCOECorpusReader

Executive Summary

This vulnerability is a symlink escape issue in NLTK's YCOECorpusReader component affecting versions 3.10.0 to 3.10.3. Attackers controlling a YCOE corpus can create symlinks named 'psd' or 'pos' pointing outside the corpus directory. When functions like parsed_sents() or tagged_words() are called, they may read and return file contents from other corpora or temporary files within the NLTK data sandbox.

Useful 0 Not Useful 0

Detection Guidance

Check NLTK version with pip show nltk. If version is between 3.10.0 and 3.10.3, the system is vulnerable. Inspect YCOE corpus directories for suspicious symlinks named psd or pos pointing outside the corpus root.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to read sensitive files outside the intended corpus root but within the NLTK data sandbox. This could expose confidential data, such as files from other corpora or temporary files, leading to unauthorized information disclosure.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to version 3.10.4 or later using pip install --upgrade nltk. Remove or replace any YCOE corpora containing psd or pos symlinks. Avoid using untrusted YCOE corpora until patched.

Useful 0 Not Useful 0