{"id":"CVE-2026-126304","kind":"vulnerability","aliases":["CVE-2026-126304"],"related":[],"title":"NLTK: symlinks in YCOE corpus let attackers read files outside corpus","description":"NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox.","summary":"NLTK versions from 3.10.0 before 3.10.4 have a symlink escape in the YCOECorpusReader class. An attacker who controls a YCOE corpus can plant psd or pos directory symlinks so that parsed_sents() and tagged_words() return contents of files outside the corpus root.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nltk","package","python"],"not_affected_if":["nltk-3.10.4-or-later","nltk-below-3.10.0","trusted-corpus-only"],"how_to_check":"- Check the installed NLTK version with `pip show nltk` and see whether it is at least `3.10.4`.\n- Look for YCOE corpus data loaded from untrusted sources and check those directories for `psd` or `pos` symlinks.","fix":"- NLTK: move to `3.10.4` or later.","status":"open","published_at":"2026-11-13T10:17:35+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","triaged_at":"2026-11-13T10:50:27+00:00","updated_at":"2026-11-13T10:50:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:50:27Z","model":"claude-haiku-5-5","output":{"fix":"- NLTK: move to `3.10.4` or later.","reach":"local","title":"NLTK: symlinks in YCOE corpus let attackers read files outside corpus","impact":"medium","summary":"NLTK versions from 3.10.0 before 3.10.4 have a symlink escape in the YCOECorpusReader class. An attacker who controls a YCOE corpus can plant psd or pos directory symlinks so that parsed_sents() and tagged_words() return contents of files outside the corpus root.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","nltk"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Arbitrary local files readable through corpus reader output","analyst_note":"","how_to_check":"- Check the installed NLTK version with `pip show nltk` and see whether it is at least `3.10.4`.\n- Look for YCOE corpus data loaded from untrusted sources and check those directories for `psd` or `pos` symlinks.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["nltk-below-3.10.0","nltk-3.10.4-or-later","trusted-corpus-only"],"who_is_affected":"Teams that run NLTK 3.10.0 up to but not including 3.10.4 and load YCOE corpora from sources they do not fully control. Exposure depends on whether untrusted corpus files can reach the application's NLTK data path. Teams on other versions or using only trusted, locally built corpora can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4635,"output_tokens":566,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126304':14A,17A '-2026':13A,16A '3.10.0':24B,66C '3.10.4':26B,68C 'allow':77C 'attack':7A,36B,78C,93C 'class':34B 'contain':69C 'content':57B,107C 'control':38B,94C 'corpora':110C 'corpus':5A,11A,41B,62B,84C,97C 'cve':12A,15A 'data':117C 'directori':47B,91C 'escap':30B,72C 'file':9A,59B,81C,106C,113C 'let':6A 'make':99C 'nltk':1A,18B,21B,64C,116C 'outsid':10A,60B,82C 'packag':19B 'pars':51B,100C 'plant':43B,87C 'pos':46B,90C 'psd':44B,88C 'python':20B 'read':8A,80C 'return':56B,105C 'root':63B,85C 'sandbox':118C 'sent':52B,101C 'symlink':2A,29B,48B,71C,92C 'tag':54B,103C 'temporari':112C 'version':22B 'vulner':73C 'within':114C 'word':55B,104C 'ycoe':4A,40B,96C 'ycoecorpusread':33B,75C","nicknames":[],"mitigations":[],"who_affected":"Teams that run NLTK 3.10.0 up to but not including 3.10.4 and load YCOE corpora from sources they do not fully control. Exposure depends on whether untrusted corpus files can reach the application's NLTK data path. Teams on other versions or using only trusted, locally built corpora can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","nltk","package","python"],"campaign_type":null,"search_a":"'-126304':14A,17A '-2026':13A,16A 'attack':7A 'corpus':5A,11A 'cve':12A,15A 'file':9A 'let':6A 'nltk':1A 'outsid':10A 'read':8A 'symlink':2A 'ycoe':4A","search_b":"'3.10.0':24B '3.10.4':26B 'attack':36B 'class':34B 'content':57B 'control':38B 'corpus':41B,62B 'directori':47B 'escap':30B 'file':59B 'nltk':18B,21B 'outsid':60B 'packag':19B 'pars':51B 'plant':43B 'pos':46B 'psd':44B 'python':20B 'return':56B 'root':63B 'sent':52B 'symlink':29B,48B 'tag':54B 'version':22B 'word':55B 'ycoe':40B 'ycoecorpusread':33B","search_c":"'3.10.0':66C '3.10.4':68C 'allow':77C 'attack':78C,93C 'contain':69C 'content':107C 'control':94C 'corpora':110C 'corpus':84C,97C 'data':117C 'directori':91C 'escap':72C 'file':81C,106C,113C 'make':99C 'nltk':64C,116C 'outsid':82C 'pars':100C 'plant':87C 'pos':90C 'psd':88C 'read':80C 'return':105C 'root':85C 'sandbox':118C 'sent':101C 'symlink':71C,92C 'tag':103C 'temporari':112C 'vulner':73C 'within':114C 'word':104C 'ycoe':96C 'ycoecorpusread':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T14:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126304","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126304","severity":null,"published_at":"2026-11-13T10:17:35+00:00","modified_at":"2026-11-13T10:17:35+00:00","first_seen_at":"2026-11-13T10:47:15+00:00","fetched_at":"2026-11-13T10:47:15+00:00","note":null}],"documents":[{"id":144937,"url":"https://github.com/nltk/nltk/security/advisories/GHSA-qg35-44qx-7vrr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T14:17:10+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144938,"url":"https://www.vulncheck.com/advisories/nltk-3.10.0-before-3.10.4-symlink-escape-in-ycoecorpusreader","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}