CVE-2026-62388
HIGHDescription
NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.
Is your site exposed to CVE-2026-62388?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| nltk | nltk |
References
Advisories & Patches
Exploits
Frequently Asked Questions
What is CVE-2026-62388? +
How severe is CVE-2026-62388? +
What products are affected by CVE-2026-62388? +
How do I check if I'm vulnerable to CVE-2026-62388? +
Related Vulnerabilities
Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value …
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions …
A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel …
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** …
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie …
oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. …