CVE-2026-122014

EUVD-2026-117114
A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/NPC-Worldwide/npcpy/
https://github.com/NPC-Worldwide/npcpy/issues/308
https://github.com/user-attachments/files/33302468/poc.zip
https://vuldb.com/cve/CVE-2026-122014
https://vuldb.com/submit/1024529
https://vuldb.com/vuln/431082
https://vuldb.com/vuln/431082/cti