Description
NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nltk | nltk | 3.10.0 <3.10.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nltk | >= 3.10.0, < 3.10.4 | 3.10.4 | GHSA-qg35-44qx-7vrr |