Eight advisories for nltk — one of the most widely installed Python NLP packages and a transitive dependency across large parts of the machine-learning tooling stack — were published on 2 September. The two that matter are not crashes.
A security control that is present, documented, and off
CVE-2026-62388 concerns pathsec, the module NLTK added as the remediation for earlier pickle-execution and path-traversal issues. It reads its enforcement flag from an environment variable that defaults to false, and every gate is written so that when enforcement is off it emits a warning and lets execution continue. The advisory's proof of concept shows the validation functions being called, warning, and proceeding anyway. Anyone who upgraded in response to the original pickle vulnerability and assumed they were protected was not, unless they also set the environment variable.
The one you cannot patch
CVE-2026-81726 covers model-artifact APIs that use the built-in file open on caller-controlled model paths, escaping the sandbox even when enforcement is turned on. Its affected range is versions up to and including 3.10.3, and its patched-versions field reads None. At the time of writing, 3.10.3 is the current release on PyPI. There is no version to upgrade to.
What the common framing gets wrong
"Eight new NLTK vulnerabilities, upgrade now" gets the risk ordering backwards twice. Most of the eight were already fixed in releases that shipped in July and August; the advisories are simply catching up, so the batch is not a simultaneous new exposure. And upgrading does not resolve the one that is genuinely open — the newest published release is inside the affected range. A second, quieter trap: the headline severity for the enforcement bug is a CVSS 4.0 score with no version 3.1 vector published, so quoting it alongside 3.1 scores from other advisories compares different scales, and the platform labels it high rather than critical.
The pattern of the day
NLTK's disabled enforcement and its DNS check that returns cleanly when resolution fails are the same failure shape as the agent-harness guardrail advisory published the same day: a control that answers "I could not check" with "proceed." The 2026 crop of AI supply-chain vulnerabilities is dominated less by memory corruption than by security layers that ship inert or fail open.