CVE-2026-62385 is a path traversal vulnerability in NLTK's corpus reader where an attacker can escape directory bounds through either direct selector injection or a pre-poisoned corpus index. The distinction matters because these represent different exploitation lifetimes: direct selector injection requires the attacker to control input at call time, while a poisoned index enables an attacker to contaminate state once and let subsequent users trigger the exploit passively. This is a persistent exploitation vector relevant to shared notebook environments, batch pipelines, and any scenario where corpus indices are serialized, cached, or transmitted between processes.
The API provides no mechanism for developers to assert trust boundaries on corpus index state. The frame_by_name method consumes index data without friction or warning, meaning a developer passing a selector cannot distinguish between trusted and untrusted index provenance. This design failure compounds the vulnerability: a poisoned index in a shared dataset or ML artifact becomes a silent infection vector affecting every downstream consumer.
The second-order risk is significant. The traversal outputs structured XML, which downstream XML consumers may process with their own parsing vulnerabilities—XXE, external entity expansion, or parser-specific flaws. Treat the corpus reader as patient zero in an exploit chain rather than a standalone issue.
For remediation, verify your NLTK version is 3.10.0 or later and audit all serialized corpus indices in your environment. Corrupted index state may not throw errors—it silently permits reads that should be blocked. The exposure window extends well beyond the patch date because serialized indices created under older versions persist in object stores, shared notebooks, and ML artifacts. Index integrity verification is not automated by any standard scanner; treat corpus indices as untrusted input requiring explicit validation.