Affected: Homebrew: acronym

### Summary

NLTK's downloader now blocks symlink escapes during ZIP extraction, but it still treats pre-existing hardlinks inside the install tree as ordinary in-root files. A normal package install can therefore overwrite an outside-root inode through that hardlink.

### Details

- **Vulnerability type:** Filesystem containment bypass - **Affected component:** `nltk.downloader.Downloader.download`, `nltk.downloader.Downloader.incr_download` - **Affected versions:** Published `3.9.4` and current source `v3.10.0-rc2` both reproduced for the extraction-stage overwrite. - **Patched versions:** 3.10.3 - **Root cause:** The downloader validates traversal and symlink conditions but does not reject pre-existing hardlink aliases inside the install tree.

The install flow correctly rejects a pre-existing symlink at an extraction target, yet it accepts a pre-existing hardlink at the same path. When the package is installed, extracted member data is written through the hardlink and mutates the outside inode.

### PoC

**Preconditions** - The attacker can plant files inside a writable shared downloader root on the same filesystem as the target file.

**Steps** 1. Prepare a downloader root and create a hardlink inside it that points to an outside target file. 2. Confirm a symlink at the same path is rejected as a negative control. 3. Run a normal `Downloader.download()` package install whose extracted member lands on the hardlink path. 4. Observe the outside target file is overwritten w…

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.

Withdrawn by the publisher.

Affected: PyPI: nltk

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-f794-5jv7-7672. This link is maintained to preserve external references.

## Original Description NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.

Affected: PyPI: nltk

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.

sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue sqlparse: sqlparse: Denial of Service via inefficient SQL parsing nltk: NLTK: Information Disclosure via Symlink Sandbox Bypass aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution gitpython: GitPython: Arbitrary file creation via path traversal in .gitmodules submodule names nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors nltk: NLTK: Denial of Service via unvalidated regular expressions nltk: nltk PorterStemmer: Denial of Service due to inefficient token processing nltk: NLTK: Denial of Service via Uncontrolled Recursion nltk: NLTK: Filesystem containment bypass allows local file overwrite

Affected: Ubuntu:Pro:14.04:LTS: nltk, Ubuntu:Pro:16.04:LTS: nltk, Ubuntu:Pro:18.04:LTS: nltk, Ubuntu:Pro:20.04:LTS: nltk, Ubuntu:Pro:22.04:LTS: nltk, Ubuntu:Pro:24.04:LTS: nltk, Ubuntu:Pro:26.04:LTS: nltk

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.