# CVE-2026-62388

## Summary

- **CVE ID:** CVE-2026-62388
- **Severity:** HIGH
- **CVSS Score:** 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)
- **CWE:** CWE-1188
- **Published:** Aug 22, 2026
- **Last Modified:** Aug 29, 2026

## Description

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled.

## Affected Products

- nltk — nltk (0)
- nltk — nltk (3.10.0)

## References

- [CNA](https://github.com/nltk/nltk/security/advisories/GHSA-p3m8-78j2-g5p3)
- [CNA](https://www.vulncheck.com/advisories/nltk-before-insecure-default-configuration-pathsec)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.46%
- **EPSS Percentile:** 38.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._