Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-62388 →

DEBIAN-CVE-2026-62388

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exce...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 nltk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 nltk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 nltk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1"}]}]

Références

advisory security-tracker.debian.org