GHSA-j456-xh4h-cpf2: Path Traversal

Q: What impact does the available severity vector indicate?

The vector indicates low confidentiality impact, high integrity impact, and low availability impact. It is rated high severity at 8.6, with network access, low attack complexity, and no required privileges or user interaction.

Q: Can affected or fixed versions be identified from the available information?

No affected version range or fixed version is provided. Deployments using pip/nltk should be reviewed against the referenced advisory, pull request, and commit.

Published Oct 27, 2026

Updated

Affected Software

1 affected componentFixes available

pip/nltk<=3.10.3

3.10.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/nltk to a version that resolves this vulnerability.
Fixed in 3.10.4
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 6a1760629

Event History

Oct 27, 2026

Advisory Published

via GitHub·02:50 PM

Data Sourced

via GitHub·02:50 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What impact does the available severity vector indicate?

The vector indicates low confidentiality impact, high integrity impact, and low availability impact. It is rated high severity at 8.6, with network access, low attack complexity, and no required privileges or user interaction.

Can affected or fixed versions be identified from the available information?