CVE-2026-65915: NLTK Information Disclosure Vulnerability

CVE-2026-65915 Overview

CVE-2026-65915 is an arbitrary file read vulnerability in the Natural Language Toolkit (NLTK) Python library affecting versions before 3.10.0. The flaw resides in FileSystemPathPointer.open(), where a sandbox validation check compares a normalized path against itself. This tautological comparison renders the security check permanently inert. Attackers who can influence input to nltk.data.load() can pass file:// URLs to read arbitrary files accessible to the process user. Targets include credentials, private keys, and application configuration files. The weakness is classified under [CWE-284: Improper Access Control].

Critical Impact
Attackers with the ability to control resource identifiers passed to nltk.data.load() can read any file the Python process can access, exposing secrets and configuration data.

Affected Products

NLTK (Natural Language Toolkit) versions prior to 3.10.0
Python applications invoking nltk.data.load() with attacker-influenced input
Downstream ML and NLP pipelines that resolve NLTK resources dynamically

Discovery Timeline

2026-08-22 - CVE-2026-65915 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-65915

Vulnerability Analysis

NLTK resolves resources through its nltk.data module, which accepts URL-like identifiers including file:// schemes. Loading a resource ultimately invokes FileSystemPathPointer.open(), which is expected to constrain reads to a designated data root. The implementation normalizes the requested path and then compares that normalized path against itself. The check always evaluates true, so no containment is enforced. An attacker who controls the resource identifier can escape any intended sandbox and read files outside the NLTK data directory.

The primary impact is confidentiality. The vulnerability does not directly enable code execution or data modification, but the disclosed files often include credentials that enable further compromise. Exposure severity depends on the privileges of the Python process and the sensitivity of files it can access.

Root Cause

The root cause is a logic bug in the sandbox validation routine of FileSystemPathPointer.open(). The function normalizes the target path and compares it to the same normalized value, rather than comparing it against the allowed data root prefix. This is an [CWE-284] improper access control defect where the guard exists in code but performs no meaningful validation.

Attack Vector

Exploitation requires that an application pass attacker-controlled input to nltk.data.load() or any code path invoking FileSystemPathPointer.open(). A network-adjacent attacker who can supply a resource identifier in a request parameter, message body, or configuration value can submit a file:// URL pointing to sensitive files such as /etc/passwd, ~/.aws/credentials, or application secrets. The vulnerability requires low privileges and no user interaction. For technical specifics, see the GitHub Security Advisory GHSA-72r2-7mfr-5xr9 and the VulnCheck Advisory on NLTK Issue.

Detection Methods for CVE-2026-65915

Indicators of Compromise

Application logs recording nltk.data.load() calls with file:// scheme arguments referencing paths outside the expected NLTK data directory.
Python process file access events targeting sensitive paths such as /etc/shadow, ~/.ssh/, ~/.aws/credentials, or environment files.
Inbound requests containing URL-encoded file:// prefixes in parameters that feed NLP or ML pipelines.

Detection Strategies

Inventory Python environments and identify installations of nltk with a version below 3.10.0 using package manifests or pip list.
Perform static analysis on application code for calls to nltk.data.load() that accept user-controlled input.
Correlate web application request logs with subsequent file-read syscalls from the Python worker to detect path traversal via NLTK.

Monitoring Recommendations

Enable file integrity and access monitoring on directories that hold secrets, keys, and configuration files used by NLTK-hosting services.
Alert on Python processes opening files outside their expected working directories or NLTK data roots.
Ingest application and host telemetry into a centralized data lake to enable cross-source correlation and hunting for file:// scheme abuse.

How to Mitigate CVE-2026-65915

Immediate Actions Required

Upgrade NLTK to version 3.10.0 or later across all Python environments, including containers, virtualenvs, and CI runners.
Audit application code for any pathway that forwards untrusted input into nltk.data.load() and add strict allowlisting.
Rotate credentials and secrets stored on hosts running vulnerable NLTK versions if exploitation cannot be ruled out.

Patch Information

The issue is fixed in NLTK 3.10.0. Upgrade using pip install --upgrade nltk. Verify the resolved version in each deployment target and rebuild container images that pin older releases. See the GitHub Security Advisory GHSA-72r2-7mfr-5xr9 for release details.

Workarounds

Reject or sanitize any input containing the file:// scheme before passing it to nltk.data.load().
Restrict the Python process account to the minimum filesystem permissions required, limiting readable files to the NLTK data directory.
Run NLTK-dependent services inside a container or sandbox with read-only bind mounts scoped to expected resources.

bash

# Configuration example
pip install --upgrade 'nltk>=3.10.0'
python -c "import nltk; print(nltk.__version__)"