---
id: "CVE-2026-126295"
page: "https://infrastack.ai/live/CVE-2026-126295"
kind: "vulnerability"
aliases: ["CVE-2026-126295"]
title: "NLTK: BllipParser model paths let attackers read arbitrary local files"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["nltk", "package", "python"]
not_affected_if: ["fixed-model-paths", "no-bllipparser-use"]
published_at: "2026-11-13T10:17:34+00:00"
first_seen_at: "2026-11-13T10:47:14+00:00"
updated_at: "2026-11-13T10:54:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126295", "first_seen_at": "2026-11-13T10:47:14+00:00"}]
exploit_sources: []
---

# NLTK: BllipParser model paths let attackers read arbitrary local files

Link for people: https://infrastack.ai/live/CVE-2026-126295 (this .md is for agents)

NLTK versions from 3.10.0 before 3.10.4 do not validate model paths passed to BllipParser, so files outside NLTK data directories can be opened. An attacker who controls parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can read sensitive files or make the process hang on FIFOs and devices.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed NLTK version with `pip show nltk` and look for versions from `3.10.0` up to but not including `3.10.4`.
- Search application code for uses of `BllipParser`, `from_unified_model_dir`, `parser_model`, `reranker_features`, or `reranker_weights` that take input from users or other untrusted sources.

## Fix

- NLTK: move to `3.10.4` or later (from the advisory range).

## Timeline

- 2026-11-13T10:47:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126295

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nltk/nltk/security/advisories/GHSA-fg9w-wfp5-j933
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nltk-3.10.0-before-3.10.4-arbitrary-file-read-via-bllipparser-model-paths

## From the sources

NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_