Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-63312

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting, including sensitive system files and application credentials.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 44.5%
CVSS Severity
CVSS v3 Score 7.5
Products affected by CVE-2026-63312
  • Nltk » Nltk » Version: 2.0.1
    cpe:2.3:a:nltk:nltk:2.0.1
  • Nltk » Nltk » Version: 2.0.3
    cpe:2.3:a:nltk:nltk:2.0.3
  • Nltk » Nltk » Version: 2.0.4
    cpe:2.3:a:nltk:nltk:2.0.4
  • Nltk » Nltk » Version: 3.0.0
    cpe:2.3:a:nltk:nltk:3.0.0
  • Nltk » Nltk » Version: 3.0.1
    cpe:2.3:a:nltk:nltk:3.0.1
  • Nltk » Nltk » Version: 3.0.2
    cpe:2.3:a:nltk:nltk:3.0.2
  • Nltk » Nltk » Version: 3.0.3
    cpe:2.3:a:nltk:nltk:3.0.3
  • Nltk » Nltk » Version: 3.0.4
    cpe:2.3:a:nltk:nltk:3.0.4
  • Nltk » Nltk » Version: 3.0.5
    cpe:2.3:a:nltk:nltk:3.0.5
  • Nltk » Nltk » Version: 3.1
    cpe:2.3:a:nltk:nltk:3.1
  • Nltk » Nltk » Version: 3.2
    cpe:2.3:a:nltk:nltk:3.2
  • Nltk » Nltk » Version: 3.2.1
    cpe:2.3:a:nltk:nltk:3.2.1
  • Nltk » Nltk » Version: 3.2.2
    cpe:2.3:a:nltk:nltk:3.2.2
  • Nltk » Nltk » Version: 3.2.3
    cpe:2.3:a:nltk:nltk:3.2.3
  • Nltk » Nltk » Version: 3.2.4
    cpe:2.3:a:nltk:nltk:3.2.4
  • Nltk » Nltk » Version: 3.2.5
    cpe:2.3:a:nltk:nltk:3.2.5
  • Nltk » Nltk » Version: 3.3
    cpe:2.3:a:nltk:nltk:3.3
  • Nltk » Nltk » Version: 3.4
    cpe:2.3:a:nltk:nltk:3.4
  • Nltk » Nltk » Version: 3.4.1
    cpe:2.3:a:nltk:nltk:3.4.1
  • Nltk » Nltk » Version: 3.4.3
    cpe:2.3:a:nltk:nltk:3.4.3
  • Nltk » Nltk » Version: 3.4.4
    cpe:2.3:a:nltk:nltk:3.4.4
  • Nltk » Nltk » Version: 3.4.5
    cpe:2.3:a:nltk:nltk:3.4.5
  • Nltk » Nltk » Version: 3.5
    cpe:2.3:a:nltk:nltk:3.5
  • Nltk » Nltk » Version: 3.6
    cpe:2.3:a:nltk:nltk:3.6
  • Nltk » Nltk » Version: 3.6.1
    cpe:2.3:a:nltk:nltk:3.6.1
  • Nltk » Nltk » Version: 3.6.2
    cpe:2.3:a:nltk:nltk:3.6.2
  • Nltk » Nltk » Version: 3.6.3
    cpe:2.3:a:nltk:nltk:3.6.3
  • Nltk » Nltk » Version: 3.6.4
    cpe:2.3:a:nltk:nltk:3.6.4
  • Nltk » Nltk » Version: 3.6.5
    cpe:2.3:a:nltk:nltk:3.6.5
  • Nltk » Nltk » Version: 3.6.6
    cpe:2.3:a:nltk:nltk:3.6.6
  • Nltk » Nltk » Version: 3.6.7
    cpe:2.3:a:nltk:nltk:3.6.7
  • Nltk » Nltk » Version: 3.7
    cpe:2.3:a:nltk:nltk:3.7
  • Nltk » Nltk » Version: 3.8
    cpe:2.3:a:nltk:nltk:3.8
  • Nltk » Nltk » Version: 3.8.1
    cpe:2.3:a:nltk:nltk:3.8.1
  • Nltk » Nltk » Version: 3.9
    cpe:2.3:a:nltk:nltk:3.9
  • Nltk » Nltk » Version: 3.9.1
    cpe:2.3:a:nltk:nltk:3.9.1
  • Nltk » Nltk » Version: 3.9.2
    cpe:2.3:a:nltk:nltk:3.9.2
  • Nltk » Nltk » Version: 3.9.3
    cpe:2.3:a:nltk:nltk:3.9.3
  • Nltk » Nltk » Version: 3.9.4
    cpe:2.3:a:nltk:nltk:3.9.4


Products
Pricing
Contact Us

Shodan ® - All rights reserved