security: risk-accept nltk PYSEC-2026-597 (unreachable code path)#485
Merged
Conversation
pip-audit's scan job has been failing on every PR since this CVE surfaced -- confirmed pre-existing (identical on main, unrelated to any PR's own diff). No patched nltk release exists yet (3.9.4 is current latest on PyPI). CyClaw's only nltk usage is PorterStemmer (retrieval/stemmer.py); it never calls nltk.download()/nltk.data.load(), so the known nltk vulnerability classes (downloader zip-slip RCE, punkt/corpus-reader path traversal) live in code this repo never executes -- stemmer.py's own header comment already documented this exact reachability argument for the punkt CVE specifically. Mirrors the existing chromadb CVE-2026-45829 risk-acceptance entry's format and rigor.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
PYSEC-2026-597topip-audit.yml's--ignore-vulnlist, alongside the existingCVE-2026-45829(chromadb) entry, with a written justification comment in the same format/rigor.Why / benefit
pip-audit'sscanjob has been failing on every open PR since this CVE surfaced againstnltk==3.9.4— confirmed pre-existing and unrelated to any PR's own diff (identical failure reproduces on a clean checkout ofmain).Investigated before proposing this, rather than reflexively ignore-listing:
3.9.4is the current latest nltk release. There is nothing to bump to.from nltk.stem import PorterStemmer(retrieval/stemmer.py) — grepped to confirm. It never callsnltk.download()ornltk.data.load(). The nltk vulnerability classes on record (downloader zip-slip RCE, punkt/corpus-reader path traversal) all live in code this repo never executes.stemmer.py's own header comment already made this exact reachability argument for the punkt tokenizer specifically — this PR just extends the same already-established reasoning to the newly-surfaced CVE and gives it a formal, auditable entry instead of leavingscanred with no explanation.Risk to monitor
Re-evaluate when nltk ships a patched release — the comment says so explicitly, matching the chromadb entry's "re-evaluate on bump" convention. If CyClaw's nltk usage ever expands beyond
PorterStemmer(e.g. adopting punkt or the downloader), this risk acceptance no longer holds and should be revisited immediately.Verify
yaml.safe_loadconfirms the file still parses. Trial-merged against the currently-open #481 (which also touchespip-audit.yml, in the unrelatedverify-installjob) — 0 conflicts, both edits coexist cleanly.Scan context
Follow-up from a CyClaw-Optimize session; not one of the original 8 scan findings — raised by
pip-audit's own CI output surfacing during that session's PR reviews.Generated by Claude Code