---
id: "GHSA-f7j6-hf97-9v99"
page: "https://infrastack.ai/live/GHSA-f7j6-hf97-9v99"
kind: "vulnerability"
aliases: ["GHSA-f7j6-hf97-9v99"]
title: "Duplicate Advisory: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read"
severity: "high"
cvss: 6.8
epss: null
exploited: false
status: "withdrawn"
category: "package"
products: [{"name": "nltk", "fixed": [], "affected": "< 3.10.4", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-22", "nlp", "nltk", "package", "python"]
not_affected_if: ["fixed-model-paths", "no-bllipparser-use"]
published_at: "2026-11-13T12:31:16+00:00"
first_seen_at: "2026-11-13T23:22:53+00:00"
updated_at: "2026-11-13T23:24:34+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-f7j6-hf97-9v99", "first_seen_at": "2026-11-13T23:22:53+00:00"}]
exploit_sources: []
---

# Duplicate Advisory: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read

Link for people: https://infrastack.ai/live/GHSA-f7j6-hf97-9v99 (this .md is for agents)

This advisory is withdrawn as a duplicate of GHSA-fg9w-wfp5-j933. The original text says NLTK 3.10.0 before 3.10.4 lets an attacker supply unvalidated model paths to BllipParser, so the C extension opens files outside the NLTK data roots and can block on FIFOs and devices.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:nltk affected < 3.10.4 fixed no fixed version listed

## How to check

- Check the installed NLTK version with `pip show nltk`.
- Look for code that passes caller-controlled values into `parser_model`, `reranker_features`, `reranker_weights`, or `from_unified_model_dir()` in BllipParser.

## Fix

- `nltk` `3.10.4` (fixed version in the product data; the withdrawn advisory points to GHSA-fg9w-wfp5-j933 for the fix)

## Timeline

- 2026-11-13T23:22:53+00:00 ghsa https://github.com/advisories/GHSA-f7j6-hf97-9v99

## From the sources

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-fg9w-wfp5-j933. This link is maintained to preserve external references.

## Original Description

NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_