CVE-2026-62388: NLTK before 3.10.0 Insecure Default Configuration pathsec
NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NLTKto a version that resolves this vulnerability.Fixed in 3.10.0 - Configuration
Ensure ENFORCE is set to True in pathsec.py (versions before 3.10.0 default to ENFORCE=False, which disables enforcement by turning validations into warnings instead of exceptions).
NLTK pathsec.py ENFORCE = True
Event History
Frequently Asked Questions
Which deployments are exposed by default?
NLTK versions before 3.10.0 are exposed when using the default pathsec.py configuration, because ENFORCE defaults to False. In that state, security validation functions warn instead of raising exceptions.
What does an attacker need to exploit this issue?
An attacker needs an opportunity to trigger code paths that rely on NLTK's path traversal or pickle deserialization protections. No authentication or user interaction is required according to the supplied severity vector.
Is there a mitigation if upgrading is not immediately possible?
Manually enable the pathsec security controls by setting ENFORCE to True. This changes validation failures from warnings to exceptions and activates the described protections.
How can I determine whether an installation is affected?
Check whether the installed NLTK version is earlier than 3.10.0 and inspect pathsec.py configuration. An installation is affected by this default-configuration issue if ENFORCE is set to False or left at its default value.