nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors (CVE-2026-79674)

Overview

A flaw was found in NLTK. A path traversal vulnerability in corpus-reader constructors allows a remote attacker to bypass the intended data root sandbox. By supplying arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors, an attacker can read files and access SQLite databases outside the security boundary, leading to information disclosure.

Vendor advisories

• Red Hat VEX · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · no fix planned: Exploit Intelligence, Red Hat Ansible Automation Platform 2, Lightspeed Core, OpenShift Lightspeed, … · updated 2026-09-15 · vex

nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors — rated Important by Red Hat. Released 2026-08-25, updated 2026-09-15.

Affected:

• Exploit Intelligence
• Lightspeed Core
• OpenShift Lightspeed
• Red Hat Ansible Automation Platform 2
• Red Hat OpenShift AI (RHOAI)

No fix planned:

• Exploit Intelligence
• Red Hat Ansible Automation Platform 2
• Lightspeed Core
• OpenShift Lightspeed
• Red Hat OpenShift AI (RHOAI)

Not affected:

• OpenShift Lightspeed

Remediation

Will not fix

Workarounds / mitigations:

• Sanitize user input passed to LinThesaurusCorpusReader and PanLexLiteCorpusReader initialization arguments to enforce strict path validation against expected data root directories before loading corpus files or SQLite databases.

Package advisory (CVE-2026-79674)

Affected packages:

• nltk < 3.10.3

Patched in:

• nltk 3.10.3

Source: https://osv.dev/vulnerability/GHSA-3gq4-3j92-5w49