CVE-2026-63312

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63312
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63312.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63312
Aliases
  • GHSA-x5ph-mj9p-rfr8
Downstream
Published
2026-08-22T14:12:40.731Z
Modified
2026-08-25T03:51:27.902532242Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read
Details

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting, including sensitive system files and application credentials.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63312.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/nltk/nltk

Affected ranges

Type
GIT
Repo
https://github.com/nltk/nltk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bd49f9011d7dc8c6a36b3c4ae71f04060c9b3fb9
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.10.0"
        }
    ]
}

Affected versions

2.*
2.0.1rc1
2.0.1rc2
2.0.1rc3
2.0.1rc4
3.*
3.0.0b1
3.0.2
3.0.3
3.0.4
3.0.5
3.0a4
3.1
3.2
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.3
3.4
3.4.1
3.4.3
3.4.4
3.5
3.5b1
3.6
3.6.1
3.6.2
3.6.5
3.6.6
3.6.7
3.7
3.8
3.8.1
3.8.2
3.9
3.9.1
3.9.2
3.9.3
3.9.4
v3.*
v3.10.0-rc1
v3.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63312.json"