CVE-2026-63312 nltk CVE debrief

Who should care

Users of NLTK versions before 3.10.0, especially those handling sensitive data or with exposure to untrusted input, should be aware of this vulnerability. This includes developers, data scientists, and security teams who use or manage NLTK installations. Additionally, operators of systems that process sensitive information or are subject to regulatory compliance may need to prioritize remediation to prevent potential data breaches.

Technical summary

CVE-2026-63312 is a HIGH-rated vulnerability in NLTK's StreamBackedCorpusView before version 3.10.0. Attackers can read arbitrary local files by bypassing pathsec.ENFORCE via direct calls to builtins.open(), controlling the fileid argument. This vulnerability has a CVSS score of 8.7, indicating a high severity level. Affected systems may be exposed to unauthorized file access, potentially leading to sensitive information disclosure.

Defensive priority

CVE-2026-63312 is rated HIGH with a CVSS score of 8.7; attackers can read arbitrary local files with control of the fileid argument in StreamBackedCorpusView before NLTK 3.10.0.

Recommended defensive actions

• Inventory and triage of NLTK installations for version compliance with 3.10.0
• Restrict access to sensitive files and application credentials
• Monitor for suspicious file access attempts
• Implement compensating controls for sensitive data access
• Review vendor advisories for additional guidance
• Conduct vulnerability scanning for exposed systems
• Track remediation progress and verify fixes

Evidence notes

The CVE-2026-63312 vulnerability affects NLTK versions before 3.10.0. Details are from NVD and vendor advisories, which indicate that attackers can control the fileid argument in StreamBackedCorpusView to read arbitrary local files, bypassing pathsec.ENFORCE via direct calls to builtins.open(). Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify NLTK version compliance and review access controls for sensitive files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.