{"id":"CVE-2026-62388","title":"NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions","summary":"NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by e…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-1188"],"vendor":"nltk","product":"nltk","affected":["nltk < 3.10.0"],"patched":["nltk 3.10.0"],"published":"2026-08-22","updated":"2026-10-14","sourceUpdated":"2026-10-14T13:10:00.187","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62388","references":[{"url":"https://github.com/nltk/nltk/security/advisories/GHSA-p3m8-78j2-g5p3","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/nltk-before-insecure-default-configuration-pathsec","label":"disclosure@vulncheck.com"},{"url":"https://github.com/nltk/nltk/security/advisories/GHSA-p3m8-78j2-g5p3","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-62388.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-62388"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521328"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-62388"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62388"},{"url":"https://github.com/nltk/nltk/pull/3593"},{"url":"https://github.com/nltk/nltk/commit/155e40343cff0bf50d233e274a12e04d1428b1d9"},{"url":"https://github.com/nltk/nltk/releases/tag/v3.10.0"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3722.yaml"},{"url":"https://github.com/advisories/GHSA-p3m8-78j2-g5p3"}],"tags":["nvd","csaf","vex","red-hat","ghsa","pip"],"epss":0.00512,"epssPercentile":0.43493,"ingestedAt":"2026-08-23T04:42:15.239Z","aliases":["GHSA-p3m8-78j2-g5p3"],"ecosystem":"pip","slug":"CVE-2026-62388","body":"## Overview\n\nNLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.\n\n## Affected\n\n- `nltk < 3.10.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `nltk 3.10.0`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Lightspeed Core, Red Hat Ansible Automation Platform 2 · no fix planned: Red Hat Ansible Automation Platform 2, Lightspeed Core · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-62388.json)\n\n## Package advisory (CVE-2026-62388)\n\nAffected packages:\n\n- `nltk <= 3.9.4`\n\nPatched in:\n\n- `nltk 3.10.0`\n\nSource: https://github.com/advisories/GHSA-p3m8-78j2-g5p3","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}