CVE-2026-54293

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.0-rc1

Description The nltk.data.load() function is subject to path traversal when using the nltk: URL scheme. The issue arises because the UNSAFE NO PROTOCOL RE regex check is performed on the raw resource string before the url2pathname() function decodes percent-encoded sequences. This decode-after-check flaw allows attackers to bypass security protections by using URL-encoded path separators (e.g., %2f for /) and traversal segments (e.g., %2e%2e%2f for ../), enabling the reading of arbitrary files from the filesystem. Technical details indicate the flaw involves the find(), normalize resource url(), and UNSAFE NO PROTOCOL RE components within nltk/data.py.

Recommendations Update to version 3.10.0-rc1 or later. As a temporary workaround, restrict untrusted input from reaching the nltk.data.load() function.