CVE-2026-71514

Name of the Vulnerable Software and Affected Versions NLTK versions 3.9.4 through 3.10.2

Description A path traversal issue exists in the CrubadanCorpusReader component. The load lang ngrams() function joins the corpus root with the crubadan code variable, which is the value read from the column-0 of the table.txt mapping file. Because the result is opened using the built-in open() function instead of a pathsec-validated opener, os.path.join discards the root directory if the crubadan code value is absolute. This allows the read operation to escape the corpus directory, bypassing the containment checks applied by nltk.pathsec when ENFORCE is set. An attacker controlling a corpus package can disclose file contents outside the corpus root via lang freq, provided the target paths end in -3grams.txt and the contents are parseable as token count lines.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.