CVE-2026-126302

CVSS 4.8 (medium) · published 2026-11-13

NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sql_query() that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox.

Weakness: CWE-59

Source: NVD CVE-2026-126302

References

• https://github.com/nltk/nltk/security/advisories/GHSA-xmfg-f9cm-w86q
• https://www.vulncheck.com/advisories/nltk-3.9.4-before-3.10.4-symlink-sandbox-escape-via-chat80-sql-query

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.