PT-2026-146635

CVE-2026-126304

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NLTK versions 3.10.0 through 3.10.3

Description A symlink escape issue exists in the YCOECorpusReader component. Attackers who control a YCOE corpus can plant psd or pos directory symlinks to read files outside the corpus root. This allows the parsed sents() and tagged words() functions to return content from other corpora or temporary files located within the NLTK data sandbox.

Recommendations Update NLTK to version 3.10.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Manus-Pi

Manus-Use

Vendors

Affected products

Weakness enumeration

CWE-59: Improper Link Resolution Before File Access (\'Link Following\')