CVE-2026-79676 nltk CVE debrief

Who should care

Organizations using NLTK versions before 3.10.3 should be aware of the potential path traversal vulnerability and take steps to patch or mitigate the vulnerability. This includes reviewing and updating corpus reader methods, implementing compensating controls, and monitoring for potential attacks. Security teams and vulnerability management teams should prioritize patching and verifying the vulnerability in their environments.

Technical summary

NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.pathsec.open(), allowing symlinks to escape trusted roots. Attackers who stage symlinked corpus files under a trusted data root can disclose outside-root content through normal corpus reader methods like channels(), domains(), and synonyms(). The vulnerability is caused by the use of built-in open() function instead of nltk.pathsec.open() in corpus readers, which allows symlinks to escape trusted roots. This vulnerability can be exploited by attackers to disclose outside-root content through normal corpus reader methods.

Defensive priority

Organizations using NLTK versions before 3.10.3 should prioritize patching to prevent potential path traversal attacks.

Recommended defensive actions

• Inventory and update NLTK to version 3.10.3 or later
• Implement compensating controls to monitor and restrict access to sensitive data
• Review and update corpus reader methods to prevent path traversal attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE description indicates that NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers. Attackers can disclose outside-root content through normal corpus reader methods. The vulnerability has a CVSS score of 8.2 and is classified as HIGH. To verify and mitigate this vulnerability, defenders should review the NLTK codebase, assess their current version and configurations, and implement compensating controls to monitor and restrict access to sensitive data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.