THREAT OPS › Threat News › [GHSA] GHSA-72r2-7mfr-5xr9 (medium) — NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol
[GHSA] GHSA-72r2-7mfr-5xr9 (medium) — NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol
GHSA-72r2-7mfr-5xr9 Severity: medium CVE: CVE-2026-65915
NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol
### Summary
There's a logic bug in `FileSystemPathPointer.open()` inside `nltk/data.py` that makes the sandbox check permanently inert. The guard condition is always `False` — meaning any file the process can read is accessible by pass
MITRE ATT&CK techniques
Indicators of compromise
- CVE-2026-65915cve
Original source: https://github.com/advisories/GHSA-72r2-7mfr-5xr9