CVE-2026-62388

Katalog CVE

CVSS 7.5 · High EPSS 0,51%

Kerentanan Initialization of a Resource with an Insecure Default pada nltk. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.

Rincian

Terbit di NVD

22 Agustus 2026

Terakhir diubah

27 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1188: Initialization of a Resource with an Insecure Default

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 42,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nltk/nltk/security/advisories/GHSA-p3m8-78j2-g5p3 exploit · mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/nltk-before-insecure-default-configuration-pathsec advisory pihak ketiga