CVE-2026-126295

MEDIUM 6.8

NLTK 3.10.0 before 3.10.4 Arbitrary File Read via BllipParser Model Paths

CVSS Score

6.8

EPSS Score

0.0%

EPSS Percentile

0th

NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices.

CWE	CWE-22
Vendor	nltk
Product	nltk
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for nltk nltk

Be the first to know when new medium vulnerabilities affecting nltk nltk are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Affected Versions

nltk / nltk

3.10.0 < 3.10.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/nltk/nltk/security/advisories/GHSA-fg9w-wfp5-j933 vulncheck.com: https://www.vulncheck.com/advisories/nltk-3.10.0-before-3.10.4-arbitrary-file-read-via-bllipparser-model-paths

Credits

🔍 manus-pi 🔍 manus-use