VDB
Sign up

PYSEC-2026-3731

Quick fix

PYSEC-2026-3731 — nltk: upgrade to the fixed version with the command below.

pip install --upgrade 'nltk>=3.10.0'

Details

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/nltk
Introduced in: 0Fixed in: 3.10.0
Fixpip install --upgrade 'nltk>=3.10.0'

References