Highekaf

**Name of the Vulnerable Software and Affected Versions** NLTK versions prior to 3.10.0 **Description** A path traversal issue exists in `FramenetCorpusReader` and `NKJPCorpusReader`. This allows attackers to parse XML files located outside the corpus root by providing unsafe selectors or a poisoned index state. The flaw can be exploited through the `frame by name()`, `doc()`, `lu()`, and `header()` methods using crafted parameters to read arbitrary XML files accessible to the application. **Recommendations** Update to version 3.10.0 or later.

**Name of the Vulnerable Software and Affected Versions** NLTK versions prior to 3.9.3 **Description** The downloader module fails to verify file integrity after downloading packages and before extraction. This allows attackers to use man-in-the-middle attacks or DNS poisoning to inject malicious package contents, which are then extracted without validation. **Recommendations** Update to version 3.9.3 or later.