CVE-2026-126304NLTK 3.10.0 before 3.10.4 Symlink Escape in YCOECorpusReader

Açıklama

NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-qg35-44qx-7vrr) vendor-advisory
• VulnCheck Advisory: NLTK 3.10.0 before 3.10.4 Symlink Escape in YCOECorpusReader third-party-advisory