CVE-2026-62388
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Aug 22, 2026
CISA due date
—
The record
NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-87827 Certain KGUARD DVR devices running vulnerable firmware expose a system command execution… CWE-1188
- CVE-2026-86464 In the current development version of Eclipse aeriOS, for which no official release has… CWE-1188
- CVE-2026-77348 Wallos is an open-source, self-hostable personal subscription tracker. CWE-1188
- CVE-2026-53507 oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post… CWE-1188
- CVE-2026-75062 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in… CWE-1188
- CVE-2026-55581 mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. CWE-1188
- CVE-2026-33921 The Windows installer deployed Npcap leaving its access restriction option at the… CWE-1188
- CVE-2026-16504 Deployment of the VPS.org one-click Zulip template deploys a hardcoded application… CWE-1188