Homepage

Directory Traversal Affecting nemo package, versions <2.7.3-r15

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.56% (43rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CHAINGUARDLATEST-NEMO-18572657
  • published7 Aug 2026
  • disclosed22 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 22 Jun 2026

CVE-2026-54293  (opens in a new tab)
CWE-22  (opens in a new tab)

How to fix?

Upgrade Chainguard nemo to version 2.7.3-r15 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nemo package and not the nemo package as distributed by Chainguard. See How to fix? for Chainguard relevant fixed versions and status.

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() decodes the %xx sequences (a classic decode-after-check / TOCTOU-style flaw), allowing an attacker to bypass the protection documented in NLTK's SECURITY.md and read arbitrary files from the filesystem. While literal traversal strings such as ../../../etc/passwd are correctly blocked, encoded variants such as %2fetc%2fpasswd, %2e%2e%2f..., and ..%2f..%2f slip past the regex and are subsequently decoded into a real filesystem path. This vulnerability is fixed in 3.10.0-rc1.