NLTK · GHSA-g5wx-957h-f4wj · Package
NO FIX YET · SEE WHAT TO DO
This advisory was withdrawn as a duplicate of GHSA-59f9-gqg8-mqpj. The original text says NLTK before 3.10.4 lets an attacker who controls the tab_dir argument read or overwrite model parameter files outside permitted directories.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use NLTK's MaxEnt parameter save or load functions with a directory path an attacker could influence. The sources do not describe other usage patterns. Teams that do not call these functions with external input are less exposed.
Not affected if nltk-3.10.4-or-later, no-external-tab-dir
Who cares nltk, python
pip show nltksave_maxent_params or load_maxent_params in your code, where the directory path comes from outside inputnltk 3.10.4 (the version the affected range is below, per the product data)This advisory has been withdrawn because it is a duplicate of GHSA-59f9-gqg8-mqpj. This link is maintained to preserve external references.
NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypasses the pathsec filesystem restriction mechanism. Attackers who control the tab_dir argument can read or overwrite model parameter files outside permitted data roots, because the functions call Python's built-in open() directly.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.