{"data":{"id":"dbdc380e-277e-4fde-9241-6517da658631","title":"GHSA-p4gq-832x-fm9v: Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read","summary":"NLTK's nltk.data.load() and find() functions allow path traversal through the nltk: URL scheme, letting an attacker read arbitrary local files. The _UNSAFE_NO_PROTOCOL_RE regex check runs on the raw resource string before url2pathname() decodes %xx sequences, so encoded separators and dot segments such as %2fetc%2fpasswd bypass it. The issue is tracked as CWE-22 and affects NLTK 3.9.4 and earlier under the default ENFORCE=False configuration.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-p4gq-832x-fm9v","publishedAt":"2026-06-16T14:34:15.000Z","cveId":"CVE-2026-54293","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["nltk@<= 3.9.4"],"affectedPackageNames":["nltk"],"affectedPackageRefs":["pypi:nltk"],"affectedVendors":[],"affectedVendorsRaw":["Natural Language Toolkit (NLTK)"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00633,"epssCheckedAt":"2026-11-04T18:09:14.050Z","kevDateAdded":null,"advisoryAliases":["GHSA-p4gq-832x-fm9v"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-06-16T14:34:15.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}