Pypi · Nltk · CVE-2026-79674
**Name of the Vulnerable Software and Affected Versions**
NLTK versions prior to 3.10.3
**Description**
A path sandbox bypass exists in corpus-reader constructors, enabling attackers to read files outside the intended data root. By supplying arbitrary corpus root paths to the `LinThesaurusCorpusReader` and `PanLexLiteCorpusReader` constructors, attackers can access filesystem content and SQLite databases beyond the pathsec sandbox boundary.
**Recommendations**
Update to version 3.10.3 or later.