Hi, The following vulnerability was published for nltk. CVE-2026-109956[0]: | NLTK through 3.10.3 contains a path traversal vulnerability in | WekaClassifier that allows attackers to bypass nltk.pathsec | containment by supplying unvalidated model paths. Attackers | controlling the model_filename or model argument can make the weka | JVM write files via -d or probe files via -l outside allowed data | roots. https://github.com/nltk/nltk/security/advisories/GHSA-j456-xh4h-cpf2 https://github.com/nltk/nltk/pull/3863 https://github.com/nltk/nltk/commit/6a17606293fe9d3ea1006f99dd3fed2e2b25d519 If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-109956 https://www.cve.org/CVERecord?id=CVE-2026-109956 Please adjust the affected versions in the BTS as needed.