Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validation guard and are resolved to files outside the intended corpus root when accessed via frame_by_name(), _lu_file(), or doc() methods.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-08-23 | 2 | Patch2 |
| 2026-09-08 | 1 | Disclosure1 |
🔴 NLTK (Natural Language Toolkit), Symlink-Based Sandbox Bypass, #CVE-2026-62384 (High) -DC-Sep2026-2226 https://dailycve.com/nltk-natural-language-toolkit-symlink-based-sandbox-bypass-cve-2026-62384-high-dc-sep2026-2226/
Post summary
The text announces CVE‑2026‑62384 as a high‑severity, symlink‑based sandbox bypass in NLTK, but does not provide PoC, exploit, or patch information.
CVE-2026-62384 - Symlink sandbox bypass in NLTK leads to arbitrary file read. CVSS 7.5. Update to version 3.10.2 now. #CVE #Python #infosec https://www.valtersit.com/cve/CVE-2026-62384 #CVE #CVEAlert #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta #mexico #switczerland #iceland #israel
Post summary
The tweet announces a CVE‑2026‑62384 vulnerability in NLTK, provides technical details and a CVSS score, and recommends updating to version 3.10.2 to remediate the issue.
CVE-2026-62384 - Symlink sandbox bypass in NLTK FramenetCorpusReader. Arbitrary XML file read. CVSS 7.5. Update to 3.10.2 now. https://www.valtersit.com/cve/CVE-2026-62384/ #NLTK #CVE #CVEAlert #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta #mexico #switczerland #iceland #israel
Post summary
CVE-2026-62384 is a symlink sandbox bypass in NLTK’s FramenetCorpusReader that allows arbitrary XML file reads with a CVSS score of 7.5, and it has been mitigated by updating to version 3.10.2.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nltk | nltk | - | - | - |