High severity7.5NVD Advisory· Published Aug 22, 2026· Updated Sep 2, 2026
CVE-2026-62384
CVE-2026-62384
Description
NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validation guard and are resolved to files outside the intended corpus root when accessed via frame_by_name(), _lu_file(), or doc() methods.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
nltkPyPI | >= 3.10.0, < 3.10.2 | 3.10.2 |
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/nltk/nltk/security/advisories/GHSA-f833-7jw8-xwrvnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-f833-7jw8-xwrvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-62384ghsaADVISORY
- www.vulncheck.com/advisories/nltk-framenetcorpusreader-symlink-sandbox-bypass-beforenvdThird Party AdvisoryWEB
- github.com/nltk/nltk/commit/736d3212a47de2005b85b785dde6720556d3925dghsaWEB
- github.com/nltk/nltk/pull/3726ghsaWEB
- github.com/nltk/nltk/releases/tag/v3.10.2ghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3789.yamlghsaWEB
News mentions
1- NLTK: Thirteen Path Traversal, RCE, and DoS Vulnerabilities Disclosed TogetherVypr Intelligence · Aug 22, 2026