⚠ Withdrawn by GitHub Security Advisories

Withdrawn: November 13, 2026

GHSA-f7j6-hf97-9v99HighCVSS 6.8No CVE ID named

Duplicate Advisory: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read

Published
November 13, 2026
Last Modified
November 13, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-fg9w-wfp5-j933. This link is maintained to preserve external references.

Original Description

NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices.

🎯 Affected products1

  • pip/nltk:< 3.10.4

🔗 References (4)