CVE-2026-63312

The record

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting, including sensitive system files and application credentials.

Affected packages

Related vulnerabilities

• CVE-2026-47256 OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability… CWE-22
• CVE-2026-75604 Next.js is a React framework for building full-stack web applications. CWE-22
• CVE-2026-32637 Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster… CWE-22
• CVE-2026-79676 NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that… CWE-22
• CVE-2026-78677 GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing… CWE-22
• CVE-2026-71514 NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. CWE-22
• CVE-2026-44517 Buildah is a tool that facilitates building OCI images. CWE-22
• CVE-2026-49114 In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file… CWE-22