{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-126295","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","state":"PUBLISHED","assignerShortName":"VulnCheck","dateReserved":"2026-11-10T20:15:54.612Z","datePublished":"2026-11-13T09:36:29.196Z","dateUpdated":"2026-11-13T20:41:23.672Z"},"containers":{"cna":{"providerMetadata":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-11-13T09:36:29.196Z"},"datePublic":"2026-10-26T00:00:00.000Z","title":"NLTK 3.10.0 before 3.10.4 Arbitrary File Read via BllipParser Model Paths","descriptions":[{"lang":"en","value":"NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices."}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","cweId":"CWE-22","type":"CWE"}]}],"affected":[{"vendor":"nltk","product":"nltk","defaultStatus":"unaffected","packageURL":"pkg:pypi/nltk","versions":[{"version":"3.10.0","status":"affected","versionType":"semver","lessThan":"3.10.4"},{"version":"3.10.4","status":"unaffected","versionType":"semver"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10.0","versionEndExcluding":"3.10.4"}]}]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":7,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":6.8,"baseSeverity":"MEDIUM"}}],"references":[{"url":"https://github.com/nltk/nltk/security/advisories/GHSA-fg9w-wfp5-j933","tags":["vendor-advisory"],"name":"GitHub Security Advisory (GHSA-fg9w-wfp5-j933)"},{"name":"VulnCheck Advisory: NLTK 3.10.0 before 3.10.4 Arbitrary File Read via BllipParser Model Paths","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/nltk-3.10.0-before-3.10.4-arbitrary-file-read-via-bllipparser-model-paths"}],"credits":[{"lang":"en","value":"manus-pi","type":"reporter"},{"lang":"en","value":"manus-use","type":"reporter"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"references":[{"url":"https://github.com/nltk/nltk/security/advisories/GHSA-fg9w-wfp5-j933","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-11-13T20:41:03.126005Z","id":"CVE-2026-126295","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-11-13T20:41:23.672Z"}}]}}