VulnerabilityAnalyzed
CVE-2026-62388
Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.
HIGH 8.7EPSS 0.46%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.
- CVSS 4.0
- 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.46% probability · 39th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1188
- Affected
- nltk/nltk
- Source
- disclosure@vulncheck.com
References
- https://github.com/nltk/nltk/security/advisories/GHSA-p3m8-78j2-g5p3Exploit, Mitigation, Vendor Advisory
- https://www.vulncheck.com/advisories/nltk-before-insecure-default-configuration-pathsecThird Party Advisory
- https://github.com/nltk/nltk/security/advisories/GHSA-p3m8-78j2-g5p3Exploit, Mitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.