CVE-2026-62388
HIGHDescription
NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.
Is your site exposed to CVE-2026-62388?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| nltk | nltk |
References
Advisories & Patches
Exploits
Frequently Asked Questions
What is CVE-2026-62388? +
How severe is CVE-2026-62388? +
What products are affected by CVE-2026-62388? +
How do I check if I'm vulnerable to CVE-2026-62388? +
Related Vulnerabilities
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View (AV / database) names …
Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. …
MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled. When this setting is disabled, state-changing requests …
A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel …
Filament is a collection of full-stack components for accelerated Laravel development. All Filament features that interact with storage use the …
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager …