Path Sandbox Bypass in NLTK Corpus Reader

Executive Summary

CVE-2026-79674 is a high-severity sandbox bypass in NLTK versions before 3.10.3. It allows attackers to read files outside the intended data root by supplying arbitrary paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors. The issue occurs because these constructors convert string roots to FileSystemPathPointer without validation, bypassing the pathsec sandbox boundary.

Useful 0 Not Useful 0

Detection Guidance

Check NLTK version with pip show nltk. If version is below 3.10.3, the system is vulnerable. Inspect code using LinThesaurusCorpusReader or PanLexLiteCorpusReader for unsanitized path inputs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to access sensitive files or SQLite databases outside the NLTK data directory. If exploited, it may lead to unauthorized data exposure or manipulation, depending on the system's file permissions and the attacker's goals.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by enabling unauthorized access to sensitive data. Organizations using affected NLTK versions may face data breaches, leading to regulatory penalties, reputational damage, and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to version 3.10.3 or later using pip install --upgrade nltk. Review and sanitize all corpus root paths in code to ensure they are validated before use.

Useful 0 Not Useful 0