{"id":"CVE-2026-126295","kind":"vulnerability","aliases":["CVE-2026-126295"],"related":[],"title":"NLTK: BllipParser model paths let attackers read arbitrary local files","description":"NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices.","summary":"NLTK versions from 3.10.0 before 3.10.4 do not validate model paths passed to BllipParser, so files outside NLTK data directories can be opened. An attacker who controls parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can read sensitive files or make the process hang on FIFOs and devices.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nltk","package","python"],"not_affected_if":["fixed-model-paths","no-bllipparser-use"],"how_to_check":"- Check the installed NLTK version with `pip show nltk` and look for versions from `3.10.0` up to but not including `3.10.4`.\n- Search application code for uses of `BllipParser`, `from_unified_model_dir`, `parser_model`, `reranker_features`, or `reranker_weights` that take input from users or other untrusted sources.","fix":"- NLTK: move to `3.10.4` or later (from the advisory range).","status":"open","published_at":"2026-11-13T10:17:34+00:00","first_seen_at":"2026-11-13T10:47:14+00:00","triaged_at":"2026-11-13T10:54:27+00:00","updated_at":"2026-11-13T10:54:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:54:27Z","model":"claude-haiku-5-5","output":{"fix":"- NLTK: move to `3.10.4` or later (from the advisory range).","reach":"unknown","title":"NLTK: BllipParser model paths let attackers read arbitrary local files","impact":"medium","summary":"NLTK versions from 3.10.0 before 3.10.4 do not validate model paths passed to BllipParser, so files outside NLTK data directories can be opened. An attacker who controls parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can read sensitive files or make the process hang on FIFOs and devices.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","nltk"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads sensitive local files or stalls the parser process","analyst_note":"Attack path and whether exploitation needs an authenticated caller are not stated in sources beyond the description.","how_to_check":"- Check the installed NLTK version with `pip show nltk` and look for versions from `3.10.0` up to but not including `3.10.4`.\n- Search application code for uses of `BllipParser`, `from_unified_model_dir`, `parser_model`, `reranker_features`, or `reranker_weights` that take input from users or other untrusted sources.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-model-paths","no-bllipparser-use"],"who_is_affected":"Applications that use NLTK's BllipParser and pass model paths that come from users or other untrusted input are exposed. Pipelines that only load fixed, locally chosen model files are unlikely to be affected. unknown whether other NLTK components are involved.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000776,"input_tokens":4641,"output_tokens":623,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126295':13A,16A '-2026':12A,15A '3.10.0':23B,74C '3.10.4':25B,76C 'allow':86C 'arbitrari':8A,79C 'attack':6A,44B,87C,100C 'bllippars':2A,33B,84C,117C 'block':124C 'c':118C 'contain':77C 'control':46B,101C 'cve':11A,14A 'data':38B,93C 'devic':71B,128C 'dir':57B,112C 'directori':39B 'extens':119C 'featur':50B,105C 'fifo':69B,126C 'file':10A,35B,62B,80C,90C,122C 'hang':67B 'input':58B,113C 'let':5A 'local':9A 'make':64B,115C 'model':3A,29B,48B,56B,98C,103C,111C 'nltk':1A,17B,20B,37B,72C,92C 'open':42B,89C 'outsid':36B,91C 'packag':18B 'parser':47B,102C 'pass':31B 'path':4A,30B,99C 'process':66B 'python':19B 'read':7A,60B,81C,120C 'rerank':49B,51B,104C,106C 'root':94C 'sensit':61B,121C 'suppli':96C 'unifi':55B,110C 'unvalid':97C 'valid':28B 'version':21B 'vulner':82C 'weight':52B,107C","nicknames":[],"mitigations":[],"who_affected":"Applications that use NLTK's BllipParser and pass model paths that come from users or other untrusted input are exposed. Pipelines that only load fixed, locally chosen model files are unlikely to be affected. unknown whether other NLTK components are involved.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","nltk","package","python"],"campaign_type":null,"search_a":"'-126295':13A,16A '-2026':12A,15A 'arbitrari':8A 'attack':6A 'bllippars':2A 'cve':11A,14A 'file':10A 'let':5A 'local':9A 'model':3A 'nltk':1A 'path':4A 'read':7A","search_b":"'3.10.0':23B '3.10.4':25B 'attack':44B 'bllippars':33B 'control':46B 'data':38B 'devic':71B 'dir':57B 'directori':39B 'featur':50B 'fifo':69B 'file':35B,62B 'hang':67B 'input':58B 'make':64B 'model':29B,48B,56B 'nltk':17B,20B,37B 'open':42B 'outsid':36B 'packag':18B 'parser':47B 'pass':31B 'path':30B 'process':66B 'python':19B 'read':60B 'rerank':49B,51B 'sensit':61B 'unifi':55B 'valid':28B 'version':21B 'weight':52B","search_c":"'3.10.0':74C '3.10.4':76C 'allow':86C 'arbitrari':79C 'attack':87C,100C 'bllippars':84C,117C 'block':124C 'c':118C 'contain':77C 'control':101C 'data':93C 'devic':128C 'dir':112C 'extens':119C 'featur':105C 'fifo':126C 'file':80C,90C,122C 'input':113C 'make':115C 'model':98C,103C,111C 'nltk':72C,92C 'open':89C 'outsid':91C 'parser':102C 'path':99C 'read':81C,120C 'rerank':104C,106C 'root':94C 'sensit':121C 'suppli':96C 'unifi':110C 'unvalid':97C 'vulner':82C 'weight':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T07:59:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126295","severity":null,"published_at":"2026-11-13T10:17:34+00:00","modified_at":"2026-11-13T10:17:34+00:00","first_seen_at":"2026-11-13T10:47:14+00:00","fetched_at":"2026-11-13T10:47:14+00:00","note":null}],"documents":[{"id":144919,"url":"https://github.com/nltk/nltk/security/advisories/GHSA-fg9w-wfp5-j933","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T07:59:16+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144920,"url":"https://www.vulncheck.com/advisories/nltk-3.10.0-before-3.10.4-arbitrary-file-read-via-bllipparser-model-paths","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}