Skip to content
fr Sign in
8.6 High

CVE-2026-0846 A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file…

Description

A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.

Affected products and versions

Product Affected versions Fixed in
Red Hat OpenShift AI 2.25 1775144403 earliest → < 1775144403 1775144403
Red Hat OpenShift AI 3.3 1778263054 earliest → < 1778263054 1778263054
Lightspeed Core Versions not published
OpenShift Lightspeed Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
nltk/nltk Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat OpenShift AI 2.25

The 140 CVEs of Red Hat OpenShift AI 2.25 →
CVE-2026-86332 A flaw was found in odh-dashboard in Red Hat OpenShift AI 6.5 Medium CVE-2026-18620 A flaw was found in Data Science Pipelines 7.1 High CVE-2026-18618 A flaw was found in ml-metadata 7.5 High CVE-2026-18611 A flaw was found in the Data Science Pipelines Operator 7.5 High
Track this CVE