NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/nltk/nltk/security/advisories/GHSA-p3m8-78j2-g5p3 Exploit, Mitigation, Vendor Advisory
- https://github.com/nltk/nltk/security/advisories/GHSA-p3m8-78j2-g5p3 Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.7 · nltkNVD modified 2026-10-14 13:10
Affected (CPE criteria) 1
cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*
References 3
- https://github.com/nltk/nltk/security/advisories/GHSA-p3m8-78j2-g5p3 Exploit, Mitigation, Vendor Advisory
- https://www.vulncheck.com/advisories/nltk-before-insecure-default-configuration-pathsec Third Party Advisory
- https://github.com/nltk/nltk/security/advisories/GHSA-p3m8-78j2-g5p3 Exploit, Mitigation, Vendor Advisory