# What changed in nltk

> 33 changes in nltk 3 from its official release notes, upgrade guides and advisories: 33 security. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/pypi/nltk/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## nltk 3

### Security

- NLTK: Allowlisted pickle loaders still permit code execution in current source (3.10.3) — [security advisory](https://github.com/advisories/GHSA-X99W-6FGC-PMFW)
- NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution (3.10.3) — [security advisory](https://github.com/advisories/GHSA-5GH2-94QG-QPPQ)
- NLTK: Corpus Reader Sandbox Bypass (3.10.3) — [security advisory](https://github.com/advisories/GHSA-3GQ4-3J92-5W49)
- NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement (3.10.3) — [security advisory](https://github.com/advisories/GHSA-P4RW-RVV2-7XWR)
- NLTK CrubadanCorpusReader path traversal allows arbitrary file disclosure (3.10.3) — [security advisory](https://github.com/advisories/GHSA-CV22-G7MW-8V73)
- NLTK: Downloader.download follows hardlinks and overwrites outside-root files (3.10.3) — [security advisory](https://github.com/advisories/GHSA-F794-5JV7-7672)
- NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses (3.10.3) — [security advisory](https://github.com/advisories/GHSA-97QJ-X29F-37W7)
- NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841) (3.10.3) — [security advisory](https://github.com/advisories/GHSA-M4RF-3FR8-XWX3)
- NLTK: pathsec SSRF protection can be bypassed when a proxy is configured (3.10.3) — [security advisory](https://github.com/advisories/GHSA-6WW7-3FRV-CQXH)
- NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks (3.10.3) — [security advisory](https://github.com/advisories/GHSA-8MPW-7FPC-4GQJ)
- NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()` (3.10.3) — [security advisory](https://github.com/advisories/GHSA-VP2X-QP44-57V7)
- NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y' (3.10.3) — [security advisory](https://github.com/advisories/GHSA-WW6M-CW3F-Q94G)
- NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions (3.10.3) — [security advisory](https://github.com/advisories/GHSA-W3V8-GMH9-3WV7)
- NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input (3.10.3) — [security advisory](https://github.com/advisories/GHSA-CW6X-M8JW-QMRH)
- NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars (3.10.3) — [security advisory](https://github.com/advisories/GHSA-FF5C-CP5C-9WJF)
- NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary (3.10.3) — [security advisory](https://github.com/advisories/GHSA-6HWM-XVPH-95VM)
- NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely (3.10.2) — [security advisory](https://github.com/advisories/GHSA-3HHW-38PF-PXJ6)
- NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292) (3.10.2) — [security advisory](https://github.com/advisories/GHSA-F833-7JW8-XWRV)
- Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode (3.10.0) — [security advisory](https://github.com/advisories/GHSA-QVV7-CG9C-W4X3)
- Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True) (3.10.0) — [security advisory](https://github.com/advisories/GHSA-XH95-F55M-82FW)
- Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True) (3.10.0) — [security advisory](https://github.com/advisories/GHSA-6HM5-JGCP-P838)
- Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex (3.10.0) — [security advisory](https://github.com/advisories/GHSA-FG7F-2386-8897)
- Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read (3.10.0) — [security advisory](https://github.com/advisories/GHSA-P4GQ-832X-FM9V)
- nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences (3.10.0) — [security advisory](https://github.com/advisories/GHSA-M42H-3232-VPV3)
- NLTK: Default ENFORCE=False Disables All pathsec Security Controls (3.10.0) — [security advisory](https://github.com/advisories/GHSA-P3M8-78J2-G5P3)
- NLTK downloader allows cross-package resource and model poisoning (3.10.0) — [security advisory](https://github.com/advisories/GHSA-FFJ6-66C4-86GW)
- NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol (3.10.0) — [security advisory](https://github.com/advisories/GHSA-72R2-7MFR-5XR9)
- NLTK network URL validation permits SSRF to RFC 6598 shared-address-space hosts (3.10.0) — [security advisory](https://github.com/advisories/GHSA-2JHM-W3MP-JCWR)
- NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions (3.10.0) — [security advisory](https://github.com/advisories/GHSA-RRV8-H7P8-RX55)
- NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure (3.10.0) — [security advisory](https://github.com/advisories/GHSA-3GQM-FCW5-W839)
- NLTK: Stable FrameNet and NKJP readers parse outside-root XML (3.10.0) — [security advisory](https://github.com/advisories/GHSA-568F-PV23-39P4)
- NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read (3.10.0) — [security advisory](https://github.com/advisories/GHSA-X5PH-MJ9P-RFR8)
- NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution (3.10.0) — [security advisory](https://github.com/advisories/GHSA-RHP5-R9X4-F5G2)