NLTK: Stable FrameNet and NKJP readers parse outside-root XML

Summary

Published nltk==3.9.4 still contains several XML-reader entrypoints that build parser paths from caller-controlled selectors or trusted-looking index state without preserving the corpus-root boundary.

Details

• Vulnerability type: Path traversal and trusted-root bypass
• Affected component: FramenetCorpusReader.frame_by_name, FramenetCorpusReader.doc, FramenetCorpusReader.lu, NKJPCorpusReader.header
• Affected versions: Published 3.9.4 reproduced. Current source v3.10.0-rc2 acted as a negative control and blocked the same payloads.
• Patched versions: Patched in version 3.10.0, which includes the path-safety rejections seen in the release candidate.
• Root cause: Stable reader paths still construct raw XML filenames from unsafe selectors, poisoned index state, or unsafe file identifiers.

I confirmed four public stable entrypoints return parsed outside-root content: a parent-segment traversal frame name, a poisoned fulltext index filename, a poisoned LU id, and an unsafe NKJP header file identifier. Current source rejects the same payloads with explicit path-safety errors, which shows the bug is real but version-scoped to the published stable package.

PoC

Preconditions

• The application exposes FrameNet or NKJP reader APIs while trusting NLTK to keep XML parsing inside a corpus root.

Steps

1. Create a minimal FrameNet or NKJP corpus root and place attacker-chosen XML files outside that root.
2. Feed unsafe selectors or poisoned index state into the relevant public stable 3.9.4 APIs.
3. Observe frame_by_name, doc, lu(...).exemplars, or header return parsed outside-root values.
4. Run the same payloads against current source and observe explicit path-safety rejections.

Minimal reproducible excerpt

framenet_frame_definition FRAME_LEAK
framenet_doc_text DOC_LEAK
framenet_lu_text LU_LEAK
nkjp_header_title HEADER_LEAK

Impact

Applications that process attacker-influenced FrameNet or NKJP corpus selectors or state can be made to parse XML outside the trusted corpus root through normal public reader responses.

Remediation