NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.

NLTK versions prior to 3.10.3 contain a path sandbox bypass vulnerability affecting corpus-reader constructors. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors, enabling unauthorized access to filesystem content and SQLite databases outside the pathsec sandbox boundary. The vulnerability allows reading of files outside the intended data root, posing a significant data exposure risk. The issue has been addressed in NLTK version 3.10.3. Advisories have been published on GitHub Security Advisories and VulnCheck. Users of affected versions should upgrade immediately to mitigate the risk of unauthorized file system access.