[GHSA] GHSA-3gq4-3j92-5w49 (high) — NLTK: Corpus Reader Sandbox Bypass

GHSA-3gq4-3j92-5w49 Severity: high CVE: CVE-2026-79674

NLTK: Corpus Reader Sandbox Bypass

## Summary

NLTK corpus-reader constructors can still reach outside-root file and database reads before the `nltk.pathsec` sandbox boundary is enforced.

The PoC shows the safe path blocked by `pathsec.open`, then `LinThesaurusCorpusReader` and `PanLexLiteCorpusReader` succeeding in the same process.

## Af