{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/nltk--3.9.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NLTK (\u003c= 3.9.4)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","cve-2026-12072","library-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Natural Language Toolkit"],"content_html":"\u003cp\u003eThe Natural Language Toolkit (NLTK) version 3.9.4 and earlier contains a critical path-traversal vulnerability (CVE-2026-12072) within the \u003ccode\u003eNKJPCorpusReader\u003c/code\u003e class. The component fails to validate or sanitize the \u003ccode\u003efileids\u003c/code\u003e parameter used in its corpus reading methods (e.g., \u003ccode\u003eheader\u003c/code\u003e, \u003ccode\u003eraw\u003c/code\u003e, \u003ccode\u003ewords\u003c/code\u003e). Instead of utilizing the \u003ccode\u003enltk.pathsec\u003c/code\u003e security framework, which is designed to prevent directory traversal and enforce strict access control, \u003ccode\u003eNKJPCorpusReader\u003c/code\u003e relies on insecure string concatenation to build file paths and subsequently invokes Python's built-in \u003ccode\u003eopen()\u003c/code\u003e function.\u003c/p\u003e\n\u003cp\u003eThis architectural flaw persists even when \u003ccode\u003enltk.pathsec.ENFORCE = True\u003c/code\u003e is set, a configuration specifically intended to protect multi-tenant and web-based applications from unauthorized file system access. An attacker capable of influencing the input to these methods can escape the intended corpus directory, leading to unauthorized disclosure of sensitive files on the host system. The vulnerability affects a wide range of NLTK corpus readers that share the same insecure pattern of using raw file operations over the provided security API.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an application endpoint or script that accepts user-supplied input used as a \u003ccode\u003efileids\u003c/code\u003e argument for NLTK's \u003ccode\u003eNKJPCorpusReader\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious path string containing directory traversal sequences (e.g., \u003ccode\u003e../../../../\u003c/code\u003e) to escape the configured corpus root directory.\u003c/li\u003e\n\u003cli\u003eThe application passes the malicious string into the \u003ccode\u003eNKJPCorpusReader.header()\u003c/code\u003e or related corpus reading method.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eNKJPCorpusReader\u003c/code\u003e performs plain string concatenation of the corpus root and the attacker-controlled \u003ccode\u003efileids\u003c/code\u003e without normalization or security validation.\u003c/li\u003e\n\u003cli\u003eThe resulting path points to a sensitive file on the host filesystem (e.g., \u003ccode\u003e/etc/passwd\u003c/code\u003e or configuration files).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eNKJPCorpusReader\u003c/code\u003e method calls the Python built-in \u003ccode\u003eopen()\u003c/code\u003e function directly with the resolved malicious path.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003enltk.pathsec\u003c/code\u003e sandbox is never consulted, bypassing the \u003ccode\u003eENFORCE=True\u003c/code\u003e security configuration.\u003c/li\u003e\n\u003cli\u003eThe application returns the content of the unintended file to the attacker, resulting in unauthorized data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the arbitrary reading of files on the host operating system with the privileges of the service account running the NLTK-based application. This poses a significant risk to web and multi-tenant environments where NLTK is utilized to process untrusted user input. Exposure of local configuration files, API keys, or system credentials could lead to full system compromise. The vulnerability affects any software utilizing NLTK \u0026lt;= 3.9.4 for corpus analysis.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate NLTK to the latest version once a patch is released that addresses the \u003ccode\u003eNKJPCorpusReader\u003c/code\u003e path validation logic.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation for any user-controlled data intended to act as a file path or identifier within NLTK readers.\u003c/li\u003e\n\u003cli\u003eAudit application code for any custom use of \u003ccode\u003eos.path.join\u003c/code\u003e or string concatenation when constructing file paths passed to NLTK corpus objects, ensuring that \u003ccode\u003eFileSystemPathPointer.open()\u003c/code\u003e is used instead of the built-in \u003ccode\u003eopen()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRestrict the privileges of the system user running the NLTK-dependent application to the minimum necessary directory access using OS-level controls (e.g., AppArmor, SELinux, or container volume restrictions).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-31T19:30:03Z","date_published":"2026-07-31T19:30:03Z","id":"https://feed.craftedsignal.io/briefs/2026-07-nltk-path-traversal/","summary":"A path-traversal vulnerability in NLTK's NKJPCorpusReader allows attackers to read arbitrary files by bypassing the nltk.pathsec security sandbox.","title":"NLTK NKJPCorpusReader Path Traversal Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-nltk-path-traversal/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NLTK (\u003c= 3.9.4)"],"_cs_severities":["high"],"_cs_tags":["ssrf","dns-rebinding","vulnerability","path-traversal","arbitrary-file-read","library-vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe NLTK library (version 3.9.4 and earlier) contains a critical SSRF filter bypass vulnerability in its \u003ccode\u003enltk.pathsec\u003c/code\u003e module, specifically within the \u003ccode\u003eurlopen\u003c/code\u003e function and underlying utilities like \u003ccode\u003enltk.data.load\u003c/code\u003e. The vulnerability stems from a race condition or logic flaw involving independent DNS resolutions: \u003ccode\u003evalidate_network_url\u003c/code\u003e performs an initial check against forbidden IP ranges (loopback, private, link-local), but the subsequent HTTP connection initiated by \u003ccode\u003eurllib\u003c/code\u003e performs a second, independent DNS resolution.\u003c/p\u003e\n\u003cp\u003eAn attacker can exploit this via DNS rebinding by providing a domain that returns a legitimate public IP during the first check, and an unauthorized internal or loopback IP during the second check. Even when \u003ccode\u003enltk.pathsec.ENFORCE\u003c/code\u003e is set to \u003ccode\u003eTrue\u003c/code\u003e, the security control is rendered ineffective. This allows for non-blind SSRF, enabling attackers to exfiltrate data from internal interfaces, administrative consoles, or cloud metadata services (e.g., 169.254.169.254), leading to potential credential theft or deeper network penetration.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sets up a malicious authoritative DNS server for a domain (e.g., rebind.attacker.test) with a TTL of 0.\u003c/li\u003e\n\u003cli\u003eAttacker provides the malicious domain as an input to a function utilizing \u003ccode\u003enltk.pathsec.urlopen\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003enltk.pathsec\u003c/code\u003e calls \u003ccode\u003e_resolve_hostname\u003c/code\u003e, which performs the first DNS lookup; the attacker's server returns a benign public IP.\u003c/li\u003e\n\u003cli\u003eThe validation logic compares the benign IP against blocklists, deems the URL safe, and allows the request to proceed.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eurlopen\u003c/code\u003e passes the raw hostname to the \u003ccode\u003eurllib\u003c/code\u003e connection layer.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eurllib\u003c/code\u003e initiates a second DNS lookup to establish the actual TCP connection.\u003c/li\u003e\n\u003cli\u003eThe attacker's DNS server returns a loopback or internal private IP for this second resolution.\u003c/li\u003e\n\u003cli\u003eThe application establishes a connection to the sensitive internal resource and returns the response body to the attacker.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability facilitates full-response (non-blind) SSRF. Attackers can read data from internal services protected by perimeter firewalls. In cloud-hosted environments, this is frequently leveraged to query instance metadata services for IAM roles, API keys, and service tokens, leading to full compromise of the affected application's identity and subsequent unauthorized access to broader cloud infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate NLTK to the latest patched version that pins the resolved IP address across the validation and connection phases.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately possible, restrict outbound network access from servers running NLTK processing tasks to prevent connections to internal RFC1918 and link-local address spaces.\u003c/li\u003e\n\u003cli\u003eImplement host-level egress filtering (e.g., using \u003ccode\u003eiptables\u003c/code\u003e or local firewall rules) to explicitly block NLTK-related service accounts from initiating connections to 127.0.0.1 or 169.254.169.254.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-31T19:30:20Z","date_published":"2026-07-31T19:29:56Z","id":"https://feed.craftedsignal.io/briefs/2026-07-nltk-ssrf-bypass/","summary":"A DNS rebinding vulnerability in the NLTK pathsec module allows attackers to bypass SSRF filters and access restricted internal resources by manipulating hostname resolution during the validation and connection phases.","title":"NLTK pathsec DNS Rebinding SSRF Filter Bypass","url":"https://feed.craftedsignal.io/briefs/2026-07-nltk-ssrf-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - NLTK (\u003c= 3.9.4)","version":"https://jsonfeed.org/version/1.1"}