CVE-2026-62384: nltk from 3.10.0 (inclusive), before 3.10.2 (exclusive), 3.10.0 to before 3.10.2

Affected technology

nltk · from 3.10.0 (inclusive), before 3.10.2 (exclusive)
nltk

nltk · 3.10.0 to before 3.10.2
nltk

Description’s affected range: versions before 3.10.2

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validation guard and are resolved to files outside the intended corpus root when accessed via frame_by_name(), _lu_file(), or doc() methods. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality impact as high; integrity and availability impact as none.