NLTK 3.10.0–3.10.3 vulnerable to symlink-based data reads; upgrade to 3.10.4

GitHub Advisories published advisory GHSA-qg35-44qx-7vrr for CVE-2026-126304 in NLTK, a Python natural language processing library. The issue involves YCOECorpusReader and may cause an application to read data outside the corpus root under a specific configuration.

Overview and technical details

The stated cause is that validation of a child path does not bind that path to the corpus root. The impact is reading data outside the corpus root but still within the permitted NLTK data sandbox; the impact is read-only.

Affected systems

The stated condition is that an application loads a YCOE corpus containing third-party-controlled content in an allowed NLTK data root, with pathsec.ENFORCE=True. Symlinks pointing outside every allowed NLTK data root are rejected; real psd or pos directories that are not symlinks do not reproduce the issue.

Mechanism and impact

The psd or pos directories may be symlinks pointing to another location within the NLTK data sandbox. YCOECorpusReader creates a sub-reader from a path checked lexically, while the CorpusReader.__init__ check does not bind the child path to the corpus root.

As a result, parsed_sents(), tagged_words() and related methods may read data outside the corpus root but still within the permitted sandbox. The data exposure is limited to the sandbox; arbitrary files outside all permitted roots cannot be read. The described impact is read-only and does not affect integrity or availability.

System checks

1. Check the NLTK version installed in the Python environment with:

   Copy commands

   python -c "import nltk; print(nltk.__version__)"

2. Alternatively, inspect the installed package information with:

   Copy commands

   pip show nltk

Versions 3.10.0 through 3.10.3 are affected; 3.10.4 is the fixed version.

Remediation and mitigation

1. Prioritize upgrading pip:nltk to version 3.10.4. This is especially relevant if an application loads shared, downloaded, or third-party-controlled YCOE corpus content in an allowed NLTK data root.