This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-62388 →

DEBIAN-CVE-2026-62388

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exce...

Original description

The description as published by the source.

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 nltk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 nltk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 nltk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1"}]}]

References

advisory security-tracker.debian.org