CPE
NLTK versions prior to 3.10.0 are vulnerable to path traversal (CVE-2026-12243) due to improper sequence decoding in nltk.data.load(), allowing attackers to read arbitrary files.