CVE-2026-79674

HighCVSS 8.2/10Last modified Aug 31, 2026

Description

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Aug 31, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-796759.8NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to CVE-2026-796765.9NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() in CVE-2026-796777.5Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of servi CVE-2026-796788.1A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() c CVE-2026-796798.7Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit use CVE-2026-79683.1Insufficient validation of untrusted input in CORS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the CVE-2026-796804.5Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modi CVE-2026-796828.8Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vul CVE-2026-796838.8Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially explo CVE-2026-796848.8Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially explo CVE-2026-796856.5Dell PowerStore contains an Argument Injection vulnerability. An authenticated user with limited privileges could potentially exploit this v CVE-2026-796868.8Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially explo