CVE-2026-65915: high-severity vulnerability in nltk
NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.4%
NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
nltk · nltkRelated CVEs — nltk
In the same product, most dangerous first.
CVE-2021-43854HIGHInefficient Regular Expression Complexity in nltkEPSS 2.8%CVE-2026-79657CRITICALNLTK before 3.10.3 Remote Code Execution via Unsafe Pickle DeserializationEPSS 1.3%CVE-2026-33231HIGHNLTK has unauthenticated remote shutdown in nltk.app.wordnet_appEPSS 1.3%CVE-2026-71513HIGHNLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name BypassEPSS 1.1%CVE-2026-79675CRITICALNLTK before 3.10.3 JVM Argument Injection via Per-Call OptionsEPSS 0.8%CVE-2026-72818HIGHNLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like InputEPSS 0.7%