Pypi · Nltk · CVE-2026-63312
**Name of the Vulnerable Software and Affected Versions**
NLTK versions prior to 3.10.0
**Description**
An arbitrary local file read issue exists in `StreamBackedCorpusView` where the system bypasses `pathsec.ENFORCE` by calling `builtins.open()` directly instead of `pathsec.open()`. Attackers who control the `fileid` argument can read arbitrary local files, including sensitive system files and application credentials, regardless of the `ENFORCE` setting.
**Recommendations**
Update NLTK to version 3.10.0 or later.