CVE-2026-62388
CVE-2026-62388: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.5
High [CVE-2026-62388] Bypass of path traversal and pickle deserialization protections due to insecure default configuration
CVE-2026-62388Source published Source updated
NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only active when manually enabled. A flaw was found in NLTK. The software's default settings in `pathsec.py` cause security checks to only issue warnings rather than actively preventing malicious actions. This allows attackers to bypass safeguards designed to prevent unauthorized access to files (path traversal) and the execution of harmful code through data processing (pickle deserialization). NLTK versions before 3.10.0 in Red Hat products are configured by default to not enforce security validations for…
- Affected products in this advisory
- Lightspeed Core
- Red Hat Ansible Automation Platform 2
- Source-reported affected versions
- < 3.10.0
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- To mitigate this issue, ensure that the NLTK security validation enforcement is enabled. This can be achieved by setting `nltk.internals.pathsec.ENFORCE = True` in your application's initialization code before processing untrusted data. This change may require restarting any services or applications that utilize NLTK.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.