Affected: Homebrew: acronym

### Summary

NLTK's downloader now blocks symlink escapes during ZIP extraction, but it still treats pre-existing hardlinks inside the install tree as ordinary in-root files. A normal package install can therefore overwrite an outside-root inode through that hardlink.

### Details

- **Vulnerability type:** Filesystem containment bypass - **Affected component:** `nltk.downloader.Downloader.download`, `nltk.downloader.Downloader.incr_download` - **Affected versions:** Published `3.9.4` and current source `v3.10.0-rc2` both reproduced for the extraction-stage overwrite. - **Patched versions:** 3.10.3 - **Root cause:** The downloader validates traversal and symlink conditions but does not reject pre-existing hardlink aliases inside the install tree.

The install flow correctly rejects a pre-existing symlink at an extraction target, yet it accepts a pre-existing hardlink at the same path. When the package is installed, extracted member data is written through the hardlink and mutates the outside inode.

### PoC

**Preconditions** - The attacker can plant files inside a writable shared downloader root on the same filesystem as the target file.

**Steps** 1. Prepare a downloader root and create a hardlink inside it that points to an outside target file. 2. Confirm a symlink at the same path is rejected as a negative control. 3. Run a normal `Downloader.download()` package install whose extracted member lands on the hardlink path. 4. Observe the outside target file is overwritten w…

Affected: nltk

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.

Affected: PyPI: nltk

### Summary

NLTK's downloader now blocks symlink escapes during ZIP extraction, but it still treats pre-existing hardlinks inside the install tree as ordinary in-root files. A normal package install can therefore overwrite an outside-root inode through that hardlink.

### Details

- **Vulnerability type:** Filesystem containment bypass - **Affected component:** `nltk.downloader.Downloader.download`, `nltk.downloader.Downloader.incr_download` - **Affected versions:** Published `3.9.4` and current source `v3.10.0-rc2` both reproduced for the extraction-stage overwrite. - **Patched versions:** 3.10.3 - **Root cause:** The downloader validates traversal and symlink conditions but does not reject pre-existing hardlink aliases inside the install tree.

The install flow correctly rejects a pre-existing symlink at an extraction target, yet it accepts a pre-existing hardlink at the same path. When the package is installed, extracted member data is written through the hardlink and mutates the outside inode.

### PoC

**Preconditions** - The attacker can plant files inside a writable shared downloader root on the same filesystem as the target file.

**Steps** 1. Prepare a downloader root and create a hardlink inside it that points to an outside target file. 2. Confirm a symlink at the same path is rejected as a negative control. 3. Run a normal `Downloader.download()` package install whose extracted member lands on the hardlink path. 4. Observe the outside target file is overwritten w…