https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T18:41:06.064063+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-12782 bdu:2026-12782 2026-10-02T18:41:06.377403+00:00 bdu:2026-12782 https://cve.radiocsirt.org/vuln/brew-acronym-cve-2026-79674 BREW-acronym-CVE-2026-79674 — NLTK: Corpus Reader Sandbox Bypass 2026-10-02T18:41:06.377462+00:00

Affected: Homebrew: acronym

## Summary

NLTK corpus-reader constructors can still reach outside-root file and database reads before the `nltk.pathsec` sandbox boundary is enforced.

The PoC shows the safe path blocked by `pathsec.open`, then `LinThesaurusCorpusReader` and `PanLexLiteCorpusReader` succeeding in the same process.

## Affected Product

- Product: NLTK - Asset / component: `nltk.corpus.reader` constructors - Version tested: `3.10.2` - Deployment / package / tag: commit `474af1f5a94b1b8d53fc2b6defec3a2ce7633b74` / PyPI `nltk` - Environment used for verification: Python 3.13.14

## Vulnerability Details

- Vulnerability class: path sandbox bypass / external control of file path - Required privileges: none beyond the ability to supply a corpus root path to a consumer call site - Entry point: `LinThesaurusCorpusReader(root)` and `PanLexLiteCorpusReader(root)` - Trust boundary crossed: NLTK data-root sandbox enforced by `nltk.pathsec` - Root affected functions: - [CorpusReader.__init__](https://github.com/nltk/nltk/blob/474af1f5a94b1b8d53fc2b6defec3a2ce7633b74/nltk/corpus/reader/api.py#L73-L80) - [LinThesaurusCorpusReader.__init__](https://github.com/nltk/nltk/blob/474af1f5a94b1b8d53fc2b6defec3a2ce7633b74/nltk/corpus/reader/lin.py#L37-L43) - [PanLexLiteCorpusReader.__init__](https://github.com/nltk/nltk/blob/474af1f5a94b1b8d53fc2b6defec3a2ce7633b74/nltk/corpus/reader/panlex_lite.py#L45-L46) - Measured unsafe effect: outside-root file/database reads still happen with `ENFORCE=True`

## Roo…

 https://cve.radiocsirt.org/vuln/euvd-2026-358874 EUVD-2026-358874 2026-10-02T18:41:06.377568+00:00 EUVD-2026-358874 https://cve.radiocsirt.org/vuln/fkie_cve-2026-79674 fkie_cve-2026-79674 2026-10-02T18:41:06.377589+00:00

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.

 https://cve.radiocsirt.org/vuln/ghsa-3gq4-3j92-5w49 GHSA-3gq4-3j92-5w49 — NLTK: Corpus Reader Sandbox Bypass 2026-10-02T18:41:06.377623+00:00

Affected: PyPI: nltk

## Summary

NLTK corpus-reader constructors can still reach outside-root file and database reads before the `nltk.pathsec` sandbox boundary is enforced.

The PoC shows the safe path blocked by `pathsec.open`, then `LinThesaurusCorpusReader` and `PanLexLiteCorpusReader` succeeding in the same process.

## Affected Product

- Product: NLTK - Asset / component: `nltk.corpus.reader` constructors - Version tested: `3.10.2` - Deployment / package / tag: commit `474af1f5a94b1b8d53fc2b6defec3a2ce7633b74` / PyPI `nltk` - Environment used for verification: Python 3.13.14

## Vulnerability Details

- Vulnerability class: path sandbox bypass / external control of file path - Required privileges: none beyond the ability to supply a corpus root path to a consumer call site - Entry point: `LinThesaurusCorpusReader(root)` and `PanLexLiteCorpusReader(root)` - Trust boundary crossed: NLTK data-root sandbox enforced by `nltk.pathsec` - Root affected functions: - [CorpusReader.__init__](https://github.com/nltk/nltk/blob/474af1f5a94b1b8d53fc2b6defec3a2ce7633b74/nltk/corpus/reader/api.py#L73-L80) - [LinThesaurusCorpusReader.__init__](https://github.com/nltk/nltk/blob/474af1f5a94b1b8d53fc2b6defec3a2ce7633b74/nltk/corpus/reader/lin.py#L37-L43) - [PanLexLiteCorpusReader.__init__](https://github.com/nltk/nltk/blob/474af1f5a94b1b8d53fc2b6defec3a2ce7633b74/nltk/corpus/reader/panlex_lite.py#L45-L46) - Measured unsafe effect: outside-root file/database reads still happen with `ENFORCE=True`

## Roo…

 https://cve.radiocsirt.org/vuln/pysec-2026-3736 PYSEC-2026-3736 2026-10-02T18:41:06.377716+00:00

Affected: PyPI: nltk

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.

 https://cve.radiocsirt.org/vuln/rhsa-2026:69539 RHSA-2026:69539 — Red Hat Security Advisory: RHOAI 3.5.1 - Red Hat OpenShift AI 2026-10-02T18:41:06.377747+00:00

sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue sqlparse: sqlparse: Denial of Service via inefficient SQL parsing nltk: NLTK: Information Disclosure via Symlink Sandbox Bypass aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution gitpython: GitPython: Arbitrary file creation via path traversal in .gitmodules submodule names nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors nltk: NLTK: Denial of Service via unvalidated regular expressions nltk: nltk PorterStemmer: Denial of Service due to inefficient token processing nltk: NLTK: Denial of Service via Uncontrolled Recursion nltk: NLTK: Filesystem containment bypass allows local file overwrite

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-79674 UBUNTU-CVE-2026-79674 2026-10-02T18:41:06.377806+00:00

Affected: Ubuntu:Pro:14.04:LTS: nltk, Ubuntu:Pro:16.04:LTS: nltk, Ubuntu:Pro:18.04:LTS: nltk, Ubuntu:Pro:20.04:LTS: nltk, Ubuntu:Pro:22.04:LTS: nltk, Ubuntu:Pro:24.04:LTS: nltk, Ubuntu:Pro:26.04:LTS: nltk

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.