CyberRota Analysis
AI-GeneratedVersions of NLTK prior to 3.10.3 are vulnerable to a path sandbox bypass, allowing attackers to manipulate corpus-reader constructors to access files beyond the designated data root. This vulnerability can lead to unauthorized access to sensitive filesystem content and SQLite databases, posing a significant risk to data integrity and confidentiality. Organizations using NLTK should prioritize updating to the latest version to mitigate this high-severity threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.
Related CVEs
Other vulnerabilities affecting the same vendor(s)