CVE-2026-126302: NLTK 3.9.4 before 3.10.4 Symlink Sandbox Escape via chat80.sql_query
NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sqlquery() that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using affected NLTK versions from 3.9.4 before 3.10.4 are exposed when they use nltk.sem.chat80.sql_query() and have a trusted NLTK data root that an attacker can write to.
What does an attacker need to exploit it?
The attacker needs write access to a trusted NLTK data root. They can plant a symbolic link that causes sql_query() to read a SQLite database outside the intended data-root sandbox.
Is this remotely exploitable by an unauthenticated attacker?
The provided vector indicates local access, low attack complexity, low privileges required, and no user interaction. The description specifically requires the ability to write into the trusted NLTK data root.
What versions should be remediated?
NLTK versions from 3.9.4 up to, but not including, 3.10.4 are affected. Updating to 3.10.4 or later addresses the affected version range described.