Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 1 vendor · 1 advisory

CVE-2026-79674

CVE-2026-79674: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-79674] Information disclosure via path traversal in corpus-reader constructors

    CVE-2026-79674Source published Source updated

    NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary. A flaw was found in NLTK. A path traversal vulnerability exists in NLTK's corpus reader constructors LinThesaurusCorpusReader and PanLexLiteCorpusReader. An attacker capable of supplying arbitrary corpus root inputs can read files outside the intended data directory. Data exposure is restricted to files readable by the executing process user, and OS discretionary access controls or container isolation boundaries prevent…

    Affected products in this advisory
    • Red Hat OpenShift AI 3.3
    • Red Hat OpenShift AI 3.5
    • Exploit Intelligence
    • Lightspeed Core

    3 more entries in the full advisory.

    Source-reported affected versions
    • < 3.10.3
    Source-reported fixed versions
    • rhoai/odh-llama-stack-core-rhel9:1789121286
    • rhoai/odh-ta-lmes-job-rhel9:1788935863
    • RHSA-2026:73987
    • RHSA-2026:69539
    Mitigation guidance
    • Sanitize user input passed to `LinThesaurusCorpusReader` and `PanLexLiteCorpusReader` initialization arguments to enforce strict path validation against expected data root directories before loading corpus files or SQLite databases.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features