Description

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-22T15:16:19.500Z",
  "pubdate": "2026-08-22T15:16:19.500Z",
  "executiveSummary": "NLTK versions before 3.10.0 contain a logic bug in the FileSystemPathPointer.open() method, resulting in an ineffective sandbox validation check.\nThe vulnerability allows unauthorized local or remote attackers to read arbitrary files accessible to the running process user.\nAffected systems include applications using NLTK versions prior to 3.10.0 that process untrusted data through data loading mechanisms.\nThe risk implications involve potential exposure of sensitive credentials, configuration files, and system data accessible by the application privileges.\nAn attacker can exploit this vulnerability by supplying crafted file:// URLs to the nltk.data.load() function.\nNo specific authentication or advanced privileges are required by default beyond the ability to pass inputs to the vulnerable data loading function.",
  "technicalDetails": "The root cause of the vulnerability resides in a logic flaw within the FileSystemPathPointer.open() function.\nDuring the sandbox validation check, the code compares a normalized path directly against itself instead of comparing it against the intended base sandbox boundary.\nConsequently, the security check is rendered permanently inert, bypassing all intended path traversal and sandbox restrictions.\nThe vulnerable component is the nltk.data module, specifically the FileSystemPathPointer class and its open implementation.\nAffected software versions are all NLTK releases prior to version 3.10.0.\nExploitation occurs when an attacker passes a specially crafted file:// URL as an input parameter to the nltk.data.load() function.\nBecause the sandbox validation logic compares the path against itself and passes unconditionally, the file:// URL scheme handler resolves and opens the target file path directly on the underlying filesystem.\nThe payload behavior involves directing the file access operation to arbitrary system paths outside of the intended directory constraints.\nPost-exploitation impact includes the arbitrary reading of sensitive files accessible to the operating system process user, such as database credentials, API keys, system configuration files, and source code.\nThe attack vector relies on utilizing protocol handlers within data loading functions, requiring no network exposure if the input originates from local application data, or remote exposure if the application exposes the data loading interface to untrusted users via web services or APIs."
}