Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-78682

  CVE-2026-78682: NLTK pathsec SSRF Protection Bypass via HTTP Proxy

  NLTK's built-in SSRF guard can be completely bypassed when an HTTP proxy is configured, letting an attacker route a seemingly safe public URL through the proxy to any internal-only service.

• highCVE-2026-79674

  CVE-2026-79674: NLTK Corpus Reader Constructor pathsec Sandbox Bypass

  Two NLTK corpus reader constructors let any caller supply an arbitrary filesystem path and read files or SQLite databases outside the intended NLTK data sandbox, even when the pathsec security module…

• criticalCVE-2026-78683

  CVE-2026-78683: nltk Unsafe Pickle Deserialization in TransitionParser

  NLTK's TransitionParser loads model files with Python's pickle without any class restrictions, letting an attacker execute arbitrary code by supplying a crafted model file.

• criticalCVE-2026-79657

  CVE-2026-79657: nltk Allowlisted Pickle Loader Remote Code Execution

  NLTK's 'safe' allowlisted pickle loaders trust entire module namespaces instead of exact callables, letting a crafted pickle invoke dangerous functions like subprocess.Popen or eval() during model…

• highCVE-2026-78681

  CVE-2026-78681: NLTK XML Entity Expansion (Billion Laughs) DoS

  Several XML parsing sites in NLTK used Python's standard ElementTree directly, letting an attacker feed a tiny crafted document that balloons to megabytes in memory and crashes the process.

• highCVE-2026-63312

  CVE-2026-63312: NLTK StreamBackedCorpusView Arbitrary File Read via pathsec.ENFORCE Bypass

  NLTK's corpus reader ignores the pathsec.ENFORCE sandbox and opens any file on disk directly, so an attacker who controls the fileid argument can read sensitive files even when the app has explicitly…

• highCVE-2026-70626

  CVE-2026-70626: NLTK CorpusReader Symlink Escape Arbitrary File Read

  NLTK's corpus reader trusts lexical path checks alone, so a symlink planted inside a corpus directory lets anyone read files anywhere on the filesystem that the process can reach.

• criticalCVE-2026-73842

  CVE-2026-73842: OpenChoreo cluster-gateway Missing Authentication on Internal Proxy

  OpenChoreo's cluster-gateway exposed its internal Kubernetes proxy, exec, and log-streaming APIs to any network-reachable caller with no authentication, letting an attacker read tenant Secrets and…

• high

  @typespec/spector Unauthenticated Remote Shutdown via POST /.admin/stop

  Any network-reachable attacker can kill a running @typespec/spector mock server with a single unauthenticated HTTP POST, because the shutdown endpoint has no authentication, token check, or IP…

• highCVE-2026-72793

  CVE-2026-72793: SiYuan /api/system/getConf Credential Disclosure

  SiYuan's configuration API hands the session-cookie signing key, the OS username, and encrypted-notebook key material to any anonymous reader when publish mode is on, because the non-admin masking…

• highCVE-2026-72798

  CVE-2026-72798: SiYuan renderAttributeView Publish-Access Filter Bypass

  SiYuan's publish-mode database renderer leaks content from hidden or password-protected databases through Relation and Rollup columns, and skips row-level access checks entirely when the first column…

• highCVE-2026-75911

  CVE-2026-75911: deepseek-tui (CodeWhale) Project Config allow_shell Override Enables Arbitrary Shell Execution

  A malicious .codewhale/config.toml committed to any repository can silently flip on CodeWhale's shell tool access for anyone who clones and opens that repo, letting the AI model run arbitrary…