CVE-2026-62383: Nltk

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename.

Affected products

• Nltk Nltk: from 3.10.0, before 3.10.2 (fixed in 3.10.2)

Published 2026-08-22. Last modified 2026-08-27.