GitHub Advisory Database warns about a flaw in nltk
KROMSE explanation
nltk has a serious security flaw (CVE-2026-126304, CVSS 8.7). The official record says: NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks.
No confirmed attacks and no public attack code yet.
Anyone running nltk older than 3.10.4.
- Update nltk to 3.10.4 or later.
- Not sure if you use it? KROMSE can check your product for free.
