CyberRota Analysis
AI-GeneratedVersions of NLTK prior to 3.10.0 are vulnerable due to a logic flaw in the FileSystemPathPointer.open() method, which renders the sandbox validation ineffective. This allows attackers to exploit the vulnerability by passing file:// URLs to nltk.data.load(), potentially gaining access to sensitive files such as credentials and configuration data. Organizations using affected versions should prioritize updating to mitigate the risk of unauthorized file access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files.
Related CVEs
Other vulnerabilities affecting the same vendor(s)