HighFix available
nltk — security advisory
NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.
- Products
- nltk
- Affected versions
- 3.10.0-1, 3.10.1-1, 3.10.3-1, 3.8-1, 3.8.1-1, 3.9.1-1, 3.9.1-2, 3.9.2-1, 3.9.3-1
- Fixed versions
- 3.10.0-1
- CVEs
- CVE-2026-62388
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 16:45 UTC · Revision 1
Source evidence
NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.
osv:DEBIAN-CVE-2026-62388
nltk
Fixed versions: Not specified
nltk
Fixed versions: Not specified
nltk
Fixed versions: 3.10.0-1
Complete source record
{
"id": "6cbae7e30e4dc9a4ce1207162820eccc0314203c19408d5d76b8dcbebf1d3d07",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-62388",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-62388",
"summary": "NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.",
"evidence": "osv:DEBIAN-CVE-2026-62388",
"products": [
{
"name": {
"value": "nltk",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.10.0-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.10.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.10.3-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.8-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.8.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.9.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.9.1-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.9.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.9.3-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "nltk",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.10.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "3.10.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "3.10.3-1",
"evidence": "/affected/1/versions"
},
{
"value": "3.9.1-2",
"evidence": "/affected/1/versions"
},
{
"value": "3.9.2-1",
"evidence": "/affected/1/versions"
},
{
"value": "3.9.3-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "nltk",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.10.0-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "3.9.1-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.9.2-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.9.3-1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2026-62388",
"aliases": [
"DEBIAN-CVE-2026-62388"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nltk",
"purl": "pkg:deb/debian/nltk?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.10.0-1",
"3.10.1-1",
"3.10.3-1",
"3.8-1",
"3.8.1-1",
"3.9.1-1",
"3.9.1-2",
"3.9.2-1",
"3.9.3-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62388.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nltk",
"purl": "pkg:deb/debian/nltk?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.10.0-1",
"3.10.1-1",
"3.10.3-1",
"3.9.1-2",
"3.9.2-1",
"3.9.3-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62388.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10.0-1"
}
]
}
],
"package": {
"name": "nltk",
"purl": "pkg:deb/debian/nltk?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.9.1-2",
"3.9.2-1",
"3.9.3-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62388.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T09:47:38.835468743Z",
"provider": "osv",
"upstream": [
"CVE-2026-62388"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-62388"
]
},
"related_cves": [
{
"value": "CVE-2026-62388",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 328130,
"published_at": "2026-08-22T15:16:18.967+00:00"
}