NLTK Vulnerability CVE-2026-12243 Allows Arbitrary File Read via Encoded Path Bypass

·3 views

A high-severity path traversal vulnerability (CVE-2026-12243, CVSS 7.5) has been disclosed in the Natural Language Toolkit (NLTK) for Python, affecting all versions up to and including 3.9.4. The flaw resides in the nltk.data.find() and nltk.data.load() functions, where a security check validates resource name strings before they are decoded, allowing percent-encoded sequences like %2f and %2e%2e to bypass the regex filter entirely. Once past the check, the standard library's url2pathname() decodes these sequences into traversal paths such as ../../../etc/passwd, enabling attackers to read arbitrary files from the host system without authentication. The vulnerability is a classic decode-after-check flaw and represents an incomplete fix for a previously reported path traversal issue tracked under GitHub Issue #3504. NLTK version 3.10.0 addresses the bug, and users are advised to upgrade immediately.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Turbopack is 19x faster at bundling, but that step is only 4% of your Next.js build

A developer tested Next.js 16's new default bundler, Turbopack, against webpack on a realistic 60-route application with shared components, charts, and third-party libraries. On cold builds, Turbopack delivered a 2.5x speed improvement over webpack, sitting at the lower end of the advertised 2–5x range. Warm builds showed a dramatic 19x speedup in the compile step, but total build time only improved 4x because bundling accounts for just 143ms of a 3.45-second build. The remaining time is consumed by TypeScript checking, static page generation, and Next.js orchestration — none of which Turbopack affects. A previously undocumented 6.6-second 'Collecting build traces' phase in webpack was also discovered, with no progress indicator and no coverage in existing benchmarks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds single-file Python tool to identify and explain stale Git branches

A software developer created a lightweight command-line tool called git-stale after discovering over 40 accumulated local branches in an older repository, most of which were obsolete. The tool, written as a single Python file under 6KB, requires no third-party dependencies and works with Python 3.8 and Git. It flags branches as stale based on three checks: whether they are fully merged into the default branch, whether their remote upstream has been deleted, or whether their last commit exceeds a configurable age threshold (30 days by default). Unlike built-in Git commands such as git branch --merged or git branch -vv, the tool provides a per-branch reason for deletion rather than a bare list, and automatically excludes the currently checked-out branch to prevent accidental self-deletion. The developer intentionally kept the tool dependency-free, reasoning that a cleanup utility requiring its own install process would simply never get used.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Apache Iceberg Modernizes Data Lakehouses by Fixing Hive Metastore Limitations

As data lakes scale from gigabytes to petabytes on storage systems like Amazon S3 or HDFS, managing raw files as reliable analytical tables becomes a major engineering challenge. Traditional solutions rely on Hive Metastore to track table schemas, partitions, and file locations, but this approach struggles as partition counts grow and workloads evolve. Tightly coupling a table's logical structure to its physical directory layout makes repartitioning costly, and schema changes often require rewriting historical data files. Apache Iceberg, an open table format, addresses these issues by introducing a structured metadata layer that supports snapshots, schema evolution, partition evolution, and atomic table commits. This architecture allows analytical engines like Spark, Hive, and Trino to query large datasets more reliably without being constrained by the underlying file organization.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AgentForge Uses Typed Contracts to Make Multi-Agent AI Pipelines Reliable

The AgentForge team published a practical guide on September 11, 2026, addressing a common failure point in multi-agent AI systems: unstructured communication between agents. Most frameworks pass raw text outputs from one agent to another, which can break when responses exceed token limits or omit critical context. AgentForge tackles this by requiring each agent to declare a formal input and output schema, which an orchestrator validates before any execution proceeds. If an agent returns data in the wrong type or format — such as a string where a float is expected — the pipeline halts immediately with a clear error rather than propagating a faulty result. The framework is open source and described as production-tested, with its codebase available on GitHub.

0 comments Read more at DEV Community