Is CVE-2026-79674 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-79674?

CVE-2026-79674 has a CVSS v3 severity of HIGH (8.2).

Back

CVE-2026-79674

Description

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.