From 298d1843c471b06ab9ca05a0978d1fe9b72a633a Mon Sep 17 00:00:00 2001 From: Mish Ushakov <10400064+mishushakov@users.noreply.github.com> Date: Thu, 23 Jul 2026 16:56:24 +0200 Subject: [PATCH 1/2] Update dependency nltk to v3.10.0 [SECURITY] Fixes GHSA-p4gq-832x-fm9v (CVE-2026-54293): URL-encoded path traversal in nltk.data.load() allowing arbitrary local file read. Co-Authored-By: Claude Fable 5 --- template/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/template/requirements.txt b/template/requirements.txt index 0afdb280..0f506282 100644 --- a/template/requirements.txt +++ b/template/requirements.txt @@ -19,7 +19,7 @@ gensim==4.4.0 imageio==2.37.3 joblib==1.5.3 librosa==0.11.0 -nltk==3.9.4 +nltk==3.10.0 numpy==2.3.5 numba==0.66.0 opencv-python==4.11.0.86 From a754958f58d077a36e9fd287bfcdb8fc1072e859 Mon Sep 17 00:00:00 2001 From: Mish Ushakov <10400064+mishushakov@users.noreply.github.com> Date: Thu, 23 Jul 2026 16:58:54 +0200 Subject: [PATCH 2/2] Add changeset for nltk 3.10.0 security bump Co-Authored-By: Claude Fable 5 --- .changeset/nltk-3-10-security.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/nltk-3-10-security.md diff --git a/.changeset/nltk-3-10-security.md b/.changeset/nltk-3-10-security.md new file mode 100644 index 00000000..c30f537b --- /dev/null +++ b/.changeset/nltk-3-10-security.md @@ -0,0 +1,5 @@ +--- +"@e2b/code-interpreter-template": patch +--- + +Bump `nltk` to 3.10.0 to address a security vulnerability (CVE-2026-54293)