CVE-2026-81727

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3

Description A filesystem containment bypass exists in the Downloader.download() and Downloader.incr download() methods. Attackers with write access to a shared downloader directory can create hardlinks pointing to files outside the installation root. During normal package extraction, these hardlinks allow the overwriting of files outside the intended install tree, leading to unauthorized file mutation.

Recommendations Update NLTK to version 3.10.3 or later.