CVE-2026-126295
MEDIUM
NVD
CVSS Score
6.8
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices.