SB2026080753 - Multiple vulnerabilities in Natural Language Toolkit

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080753

SB2026080753 - Multiple vulnerabilities in Natural Language Toolkit

Published: August 7, 2026

Security Bulletin ID SB2026080753
CSH Severity
High
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

High 9% Medium 82% Low 9%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-54296)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to server-side request forgery in nltk.pathsec.urlopen when validating a hostname before urllib performs a separate connection-time DNS resolution. A remote attacker can supply a hostname with attacker-controlled DNS rebinding records to disclose sensitive information.

The issue defeats the documented ENFORCE mode and can expose responses from internal-only HTTP services, including loopback administrative interfaces and cloud metadata endpoints.


2) Inefficient regular expression complexity (CVE-ID: CVE-2026-54295)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in the ReviewsCorpusReader FEATURES regex when parsing a crafted bracket-less review line. A remote attacker can supply a specially crafted reviews corpus line to cause a denial of service.

A single crafted line can hang the reviews(), features(), and sents() processing paths.


3) Path traversal (CVE-ID: CVE-2026-54292)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in FramenetCorpusReader.frame() when processing a caller-supplied frame name. A remote attacker can supply a crafted frame name containing traversal sequences to disclose sensitive information.

The issue bypasses the nltk.pathsec sandbox even when ENFORCE=True. If the target is not frame-shaped XML, parsing errors can still reveal file existence or readability.


4) Path traversal (CVE-ID: CVE-2026-54294)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in NKJPCorpusReader when processing attacker-influenced fileids in public read methods. A remote attacker can supply crafted fileids containing directory traversal sequences to disclose sensitive information.

The issue bypasses the nltk.pathsec sandbox even when ENFORCE is set to true, and the header() method returns content from out-of-root files to the caller.


5) Path traversal (CVE-ID: CVE-2026-54293)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in nltk.data.load() and related path handling in nltk/data.py when processing attacker-controlled nltk: resource URLs containing URL-encoded path separators or traversal segments. A remote attacker can supply a specially crafted resource identifier to disclose sensitive information.

The issue is caused by a decode-after-check flaw in which unsafe-path regex checks are performed before url2pathname() decodes percent-encoded sequences.


6) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in FramenetCorpusReader.frame_by_name, FramenetCorpusReader.doc, FramenetCorpusReader.lu, and NKJPCorpusReader.header when parsing caller-controlled selectors or trusted-looking index state into XML file paths. A remote attacker can supply crafted selectors, poisoned index state, or unsafe file identifiers to disclose sensitive information.

Exploitation requires the application to expose FrameNet or NKJP reader APIs and trust them to confine XML parsing to a corpus root.


7) Insecure Default Initialization of Resource (CVE-ID: N/A)

CWE-ID: CWE-1188 - Insecure Default Initialization of Resource

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to initialization of a resource with an insecure default in the pathsec security module when processing security validation checks with ENFORCE disabled by default. A remote attacker can supply a crafted path or unsafe source to bypass security checks and disclose sensitive information.

The module emits RuntimeWarning messages instead of raising exceptions, so execution continues after a violation is detected.


8) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to improper control of outbound network requests in validate_network_url() in nltk/pathsec.py when handling URLs whose hostname resolution fails. A remote attacker can supply a crafted URL to perform server-side request forgery.

The issue is caused by a fail-open condition when DNS resolution returns an error and _resolve_hostname() returns an empty list, which can also enable bypass after DNS rebinding once the cache entry expires.


9) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in StreamBackedCorpusView when processing a user-controlled fileid path while pathsec.ENFORCE is enabled. A remote attacker can supply a crafted file path to disclose sensitive information.

XMLCorpusView and corpus reader subclasses that pass a raw string fileid to StreamBackedCorpusView are also affected.


10) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in nltk.data.load() and nltk.data.find() when processing user-supplied resource names containing percent-encoded traversal sequences. A remote attacker can supply a specially crafted resource name to disclose sensitive information.

This issue affects applications that pass user-controlled input to these functions, and percent-encoded sequences such as %2e%2e are decoded after path safety checks.


11) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in FileSystemPathPointer.open() in nltk/data.py when handling file:// URLs through nltk.data.load() or user-influenced paths. A remote user can supply a crafted file:// URL or path to read arbitrary files accessible to the process and disclose sensitive information.

Applications are exposed when users can influence the string passed to nltk.data.load() or nltk.data.find().


Remediation

Install update from vendor's website.

References