---
id: CVE-2026-62388
title: >-
  NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing
  all security validation functions to emit warnings instead of raising
  exceptions
summary: >-
  NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing
  all security validation functions to emit warnings instead of raising
  exceptions. Attackers can bypass path traversal and pickle deserialization
  protections by e…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-1188
published: '2026-08-22'
updated: '2026-08-22'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-62388'
references:
  - url: 'https://github.com/nltk/nltk/security/advisories/GHSA-p3m8-78j2-g5p3'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/nltk-before-insecure-default-configuration-pathsec
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-08-23T04:42:15.239Z'
epss: 0.00457
epssPercentile: 0.38998
---

## Overview

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.