{"id":"GHSA-f7j6-hf97-9v99","kind":"vulnerability","aliases":["GHSA-f7j6-hf97-9v99"],"related":[],"title":"Duplicate Advisory: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-fg9w-wfp5-j933. This link is maintained to preserve external references.\n\n## Original Description\n\nNLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices.","summary":"This advisory is withdrawn as a duplicate of GHSA-fg9w-wfp5-j933. The original text says NLTK 3.10.0 before 3.10.4 lets an attacker supply unvalidated model paths to BllipParser, so the C extension opens files outside the NLTK data roots and can block on FIFOs and devices.","severity":"high","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nltk","fixed":[],"affected":"< 3.10.4","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-22","nlp","nltk","package","python"],"not_affected_if":["fixed-model-paths","no-bllipparser-use"],"how_to_check":"- Check the installed NLTK version with `pip show nltk`.\n- Look for code that passes caller-controlled values into `parser_model`, `reranker_features`, `reranker_weights`, or `from_unified_model_dir()` in BllipParser.","fix":"- `nltk` `3.10.4` (fixed version in the product data; the withdrawn advisory points to GHSA-fg9w-wfp5-j933 for the fix)","status":"withdrawn","published_at":"2026-11-13T12:31:16+00:00","first_seen_at":"2026-11-13T23:22:53+00:00","triaged_at":"2026-11-13T23:24:34+00:00","updated_at":"2026-11-13T23:24:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T23:24:34Z","model":"claude-haiku-5-5","output":{"fix":"- `nltk` `3.10.4` (fixed version in the product data; the withdrawn advisory points to GHSA-fg9w-wfp5-j933 for the fix)","reach":"unknown","title":"NLTK: BllipParser lets callers read arbitrary files from the host","impact":"medium","summary":"This advisory is withdrawn as a duplicate of GHSA-fg9w-wfp5-j933. The original text says NLTK 3.10.0 before 3.10.4 lets an attacker supply unvalidated model paths to BllipParser, so the C extension opens files outside the NLTK data roots and can block on FIFOs and devices.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","nltk","nlp"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"arbitrary files readable and FIFO or device reads can hang the process","analyst_note":"","how_to_check":"- Check the installed NLTK version with `pip show nltk`.\n- Look for code that passes caller-controlled values into `parser_model`, `reranker_features`, `reranker_weights`, or `from_unified_model_dir()` in BllipParser.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-model-paths","no-bllipparser-use"],"who_is_affected":"Applications that pass untrusted input into BllipParser model paths in NLTK 3.10.0 through 3.10.4. Systems that only use fixed, trusted model paths are less exposed. The advisory itself is withdrawn, so the original fix record is GHSA-fg9w-wfp5-j933.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000785,"input_tokens":4720,"output_tokens":626,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-22':34B '3.10.0':57B,117C '3.10.4':59B,119C '9v99':26A,31A 'advisori':2A,40B,88C,90C 'allow':129C 'arbitrari':20A,122C 'attack':62B,130C,143C 'bllippars':3A,12A,68B,127C,160C 'block':82B,167C 'c':13A,71B,161C 'caller':6A 'caller-suppli':5A 'check':18A 'contain':120C 'control':144C 'cwe':33B 'data':78B,136C 'descript':114C 'devic':86B,171C 'dir':155C 'duplic':1A,45B,87C,98C 'enabl':19A 'extens':14A,72B,162C 'extern':111C 'f7j6':24A,29A 'featur':148C 'fg9w':49B,102C 'fifo':84B,169C 'file':74B,123C,133C,165C 'ghsa':23A,28A,48B,101C 'ghsa-f7j6-hf97-9v99':22A,27A 'ghsa-fg9w-wfp5-j933':47B,100C 'hf97':25A,30A 'input':156C 'j933':51B,104C 'let':60B 'link':106C 'maintain':108C 'make':158C 'model':8A,65B,141C,146C,154C 'nlp':35B 'nltk':32A,36B,56B,77B,115C,135C 'open':73B,132C 'origin':53B,113C 'outsid':75B,134C 'packag':37B 'parser':145C 'pass':4A 'path':9A,66B,142C 'pathsec':17A 'preserv':110C 'python':38B 'read':21A,124C,163C 'refer':112C 'rerank':147C,149C 'root':79B,137C 'say':55B 'sensit':164C 'suppli':7A,63B,139C 'text':54B 'unifi':153C 'unvalid':64B,140C 'vulner':125C 'weight':150C 'wfp5':50B,103C 'withdrawn':42B,93C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass untrusted input into BllipParser model paths in NLTK 3.10.0 through 3.10.4. Systems that only use fixed, trusted model paths are less exposed. The advisory itself is withdrawn, so the original fix record is GHSA-fg9w-wfp5-j933.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["nltk"],"ptokens":["nltk"],"labels":["cwe22","high","nlp","nltk","package","pypi","python"],"campaign_type":null,"search_a":"'9v99':26A,31A 'advisori':2A 'arbitrari':20A 'bllippars':3A,12A 'c':13A 'caller':6A 'caller-suppli':5A 'check':18A 'duplic':1A 'enabl':19A 'extens':14A 'f7j6':24A,29A 'ghsa':23A,28A 'ghsa-f7j6-hf97-9v99':22A,27A 'hf97':25A,30A 'model':8A 'nltk':32A 'pass':4A 'path':9A 'pathsec':17A 'read':21A 'suppli':7A","search_b":"'-22':34B '3.10.0':57B '3.10.4':59B 'advisori':40B 'attack':62B 'bllippars':68B 'block':82B 'c':71B 'cwe':33B 'data':78B 'devic':86B 'duplic':45B 'extens':72B 'fg9w':49B 'fifo':84B 'file':74B 'ghsa':48B 'ghsa-fg9w-wfp5-j933':47B 'j933':51B 'let':60B 'model':65B 'nlp':35B 'nltk':36B,56B,77B 'open':73B 'origin':53B 'outsid':75B 'packag':37B 'path':66B 'python':38B 'root':79B 'say':55B 'suppli':63B 'text':54B 'unvalid':64B 'wfp5':50B 'withdrawn':42B","search_c":"'3.10.0':117C '3.10.4':119C 'advisori':88C,90C 'allow':129C 'arbitrari':122C 'attack':130C,143C 'bllippars':127C,160C 'block':167C 'c':161C 'contain':120C 'control':144C 'data':136C 'descript':114C 'devic':171C 'dir':155C 'duplic':87C,98C 'extens':162C 'extern':111C 'featur':148C 'fg9w':102C 'fifo':169C 'file':123C,133C,165C 'ghsa':101C 'ghsa-fg9w-wfp5-j933':100C 'input':156C 'j933':104C 'link':106C 'maintain':108C 'make':158C 'model':141C,146C,154C 'nltk':115C,135C 'open':132C 'origin':113C 'outsid':134C 'parser':145C 'path':142C 'preserv':110C 'read':124C,163C 'refer':112C 'rerank':147C,149C 'root':137C 'sensit':164C 'suppli':139C 'unifi':153C 'unvalid':140C 'vulner':125C 'weight':150C 'wfp5':103C 'withdrawn':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T12:31:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-f7j6-hf97-9v99","url":"https://github.com/advisories/GHSA-f7j6-hf97-9v99","severity":"high","published_at":"2026-11-13T12:31:16+00:00","modified_at":"2026-11-13T23:20:11+00:00","first_seen_at":"2026-11-13T23:22:53+00:00","fetched_at":"2026-11-13T23:22:53+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}