PyPI/nltk CVE-2026-0846: high 8.6, EPSS 0.55%

NLTK has Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

Action: Upgrade nltk to 3.9.3 or later.

pip install nltk==3.9.3

Affected

Fixed versions

Sources

• osv: GHSA-h8wq-7xc4-p3qx
• https://nvd.nist.gov/vuln/detail/CVE-2026-0846
• https://github.com/nltk/nltk/pull/3485
• https://github.com/nltk/nltk/commit/b2e1164bf89277f79b65406c829b99fb20ca1974
• https://github.com/nltk/nltk
• https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-97.yaml
• https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb

CVE-2026-0846 · published 2026-03-09T21:31:38Z · modified 2026-06-08T18:45:17.792312901Z · JSON