Attack Chain

1. Attacker identifies a web application or API that utilizes the nltk.Text.findall() method to process user-provided inputs.
2. Attacker crafts a regex payload containing nested quantifiers or overlapping groups (e.g., <((a+)+)b>) designed for exponential backtracking.
3. Attacker submits the payload via the input field exposed by the vulnerable application.
4. The application triggers nltk.Text.findall(regexp), which calls TokenSearcher.findall().
5. The library performs internal string preprocessing to wrap tokens, which does not sanitize or validate the malicious regex structure.
6. The re.findall() function executes the malformed regex against the tokenized data string.
7. The Python process enters a high-CPU state due to the catastrophic backtracking behavior, causing the application to hang or crash and denying service to other users.

Impact

Successful exploitation results in a complete denial of service for the affected Python process. Given that NLTK is frequently used in NLP-heavy backend services, this vulnerability can impact high-traffic web applications, causing system instability and availability loss for all users of the affected instance.

Recommendation

Update the nltk package to a version beyond 3.9.4 immediately to include the patch applied in commit d8e4753. Organizations cannot rely on infrastructure-level blocks for this vulnerability, as the attack is inherently application-logic based.

When pathsec.ENFORCE=True is enabled, NLTK is intended to restrict file access to trusted directories. However, because these specific readers do not preserve the trusted-root boundary during file access, a symlink placed inside a trusted corpus root can be used to traverse and access arbitrary files on the underlying filesystem. This allows an attacker to disclose sensitive outside-root content through standard public corpus-reader methods such as synonyms() or categories(). This issue affects multiple components across the NLTK codebase, including MTEFileReader and various XML-based corpus parsers.

Impact

Successful exploitation allows for unauthorized disclosure of arbitrary files on the filesystem where the NLTK library is processing corpus data. This poses a significant security risk in shared, multi-user, or automated environments where NLTK processes untrusted or attacker-influenced corpus data. The impact is limited to information disclosure and does not include write access or arbitrary code execution; however, it effectively bypasses intended sandbox protections designed to secure NLTK-based applications.

Recommendation

Prioritized actions for development and security teams:

• Update the NLTK library to a patched version once released, or apply manual remediation by wrapping all raw open() calls within affected corpus readers using nltk.pathsec.validate_path(path, required_root=...) or nltk.pathsec.open().
• Audit corpus-processing pipelines to ensure they do not rely on the inclusion of the system temporary directory within the pathsec allowed-roots configuration.
• Implement strict filesystem permissions on directories used as NLTK trusted corpus roots to prevent unauthorized creation of symlinks by untrusted users.
• Deploy internal monitoring to detect unexpected file access patterns originating from the NLTK process, particularly targeting sensitive system files or configuration paths.