Package
apache-beam-python-3.13-sdk
Component
nltk
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
NLTK versions through 3.10.3, the latest release, remain vulnerable to path traversal via the model-artifact save/load APIs (TransitionParser, AveragedPerceptron, PerceptronTagger); no released version fixes GHSA-8mgp-746c-j5xp yet, though upstream has open pull requests addressing it (nltk/nltk#3757, #3759, #3813). The package's own runtime code never calls the affected functions, so exploiting this would require additional code that reaches those specific APIs with an attacker-controlled path.
Status