CVE-2026-62388

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.0

Description In the pathsec.py file, the ENFORCE variable defaults to False, which causes security validation functions to emit warnings rather than raising exceptions. This allows attackers to bypass protections against path traversal and pickle deserialization by exploiting security controls that are inactive unless manually enabled.

Recommendations Update to version 3.10.0 or later. As a temporary mitigation, manually set ENFORCE=True in pathsec.py to ensure security validation functions raise exceptions.