Search
Find a vulnerability
Search criteria
4 vulnerabilities by NPC-Worldwide
CVE-2026-122015 (GCVE-0-2026-122015)
Vulnerability from nvd – Published: 2026-11-04 21:15 – Updated: 2026-11-04 21:15
VLAI
EPSS
VEX
Title
NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation
Summary
A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get_mlx_response of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely. The exploit has been made public and could be used.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431083 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431083/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-122015 | third-party-advisory |
| https://vuldb.com/submit/1024531 | third-party-advisory |
| https://github.com/NPC-Worldwide/npcpy/issues/309 | issue-tracking |
| https://github.com/user-attachments/files/3330258… | exploit |
| https://github.com/NPC-Worldwide/npcpy/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NPC-Worldwide | npcpy |
Affected:
2.1.0
Affected: 2.1.1 Affected: 2.1.2 Affected: 2.1.3 Affected: 2.1.4 Affected: 2.1.5 Affected: 2.1.6 Affected: 2.1.7 Affected: 2.1.8 Affected: 2.1.9 Affected: 2.1.10 Affected: 2.1.11 Affected: 2.1.12 Affected: 2.1.13 Affected: 2.1.14 Affected: 2.1.15 Affected: 2.1.16 Affected: 2.1.17 Affected: 2.1.18 Affected: 2.1.19 Affected: 2.1.20 Affected: 2.1.21 Affected: 2.1.22 Affected: 2.1.23 Affected: 2.1.24 Affected: 2.1.25 Affected: 2.1.26 Affected: 2.1.27 cpe:2.3:a:npc-worldwide:npcpy:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:npc-worldwide:npcpy:*:*:*:*:*:*:*:*"
],
"modules": [
"MLX Provider"
],
"product": "npcpy",
"vendor": "NPC-Worldwide",
"versions": [
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "2.1.1"
},
{
"status": "affected",
"version": "2.1.2"
},
{
"status": "affected",
"version": "2.1.3"
},
{
"status": "affected",
"version": "2.1.4"
},
{
"status": "affected",
"version": "2.1.5"
},
{
"status": "affected",
"version": "2.1.6"
},
{
"status": "affected",
"version": "2.1.7"
},
{
"status": "affected",
"version": "2.1.8"
},
{
"status": "affected",
"version": "2.1.9"
},
{
"status": "affected",
"version": "2.1.10"
},
{
"status": "affected",
"version": "2.1.11"
},
{
"status": "affected",
"version": "2.1.12"
},
{
"status": "affected",
"version": "2.1.13"
},
{
"status": "affected",
"version": "2.1.14"
},
{
"status": "affected",
"version": "2.1.15"
},
{
"status": "affected",
"version": "2.1.16"
},
{
"status": "affected",
"version": "2.1.17"
},
{
"status": "affected",
"version": "2.1.18"
},
{
"status": "affected",
"version": "2.1.19"
},
{
"status": "affected",
"version": "2.1.20"
},
{
"status": "affected",
"version": "2.1.21"
},
{
"status": "affected",
"version": "2.1.22"
},
{
"status": "affected",
"version": "2.1.23"
},
{
"status": "affected",
"version": "2.1.24"
},
{
"status": "affected",
"version": "2.1.25"
},
{
"status": "affected",
"version": "2.1.26"
},
{
"status": "affected",
"version": "2.1.27"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem000000 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get_mlx_response of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely. The exploit has been made public and could be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:15:18.857Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431083 | NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431083"
},
{
"name": "VDB-431083 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431083/cti"
},
{
"name": "CVE-2026-122015 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-122015"
},
{
"name": "Submit #1024531 | NPC-Worldwide npcpy 2.1.18 Improper Input Validation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1024531"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/NPC-Worldwide/npcpy/issues/309"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/33302583/poc.zip"
},
{
"tags": [
"product"
],
"url": "https://github.com/NPC-Worldwide/npcpy/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-04T15:37:14.000Z",
"value": "VulDB entry last update"
}
],
"title": "NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-122015",
"datePublished": "2026-11-04T21:15:18.857Z",
"dateReserved": "2026-11-04T14:32:02.143Z",
"dateUpdated": "2026-11-04T21:15:18.857Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122014 (GCVE-0-2026-122014)
Vulnerability from nvd – Published: 2026-11-04 21:00 – Updated: 2026-11-04 21:18
VLAI
EPSS
VEX
Title
NPC-Worldwide npcpy sft.py load_sft_model code injection
Summary
A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
AdVISE TEST Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 21:09 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431082 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431082/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-122014 | third-party-advisory |
| https://vuldb.com/submit/1024529 | third-party-advisory |
| https://github.com/NPC-Worldwide/npcpy/issues/308 | issue-tracking |
| https://github.com/user-attachments/files/3330246… | exploit |
| https://github.com/NPC-Worldwide/npcpy/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NPC-Worldwide | npcpy |
Affected:
2.1.0
Affected: 2.1.1 Affected: 2.1.2 Affected: 2.1.3 Affected: 2.1.4 Affected: 2.1.5 Affected: 2.1.6 Affected: 2.1.7 Affected: 2.1.8 Affected: 2.1.9 Affected: 2.1.10 Affected: 2.1.11 Affected: 2.1.12 Affected: 2.1.13 Affected: 2.1.14 Affected: 2.1.15 Affected: 2.1.16 Affected: 2.1.17 Affected: 2.1.18 Affected: 2.1.19 Affected: 2.1.20 Affected: 2.1.21 Affected: 2.1.22 Affected: 2.1.23 Affected: 2.1.24 Affected: 2.1.25 Affected: 2.1.26 Affected: 2.1.27 cpe:2.3:a:npc-worldwide:npcpy:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122014",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "AdVISE TEST Coordinator",
"timestamp": "2026-11-04T21:09:12.745229Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:18:23.934Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "ADP TEST CONTAINER TITLE"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:npc-worldwide:npcpy:*:*:*:*:*:*:*:*"
],
"product": "npcpy",
"vendor": "NPC-Worldwide",
"versions": [
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "2.1.1"
},
{
"status": "affected",
"version": "2.1.2"
},
{
"status": "affected",
"version": "2.1.3"
},
{
"status": "affected",
"version": "2.1.4"
},
{
"status": "affected",
"version": "2.1.5"
},
{
"status": "affected",
"version": "2.1.6"
},
{
"status": "affected",
"version": "2.1.7"
},
{
"status": "affected",
"version": "2.1.8"
},
{
"status": "affected",
"version": "2.1.9"
},
{
"status": "affected",
"version": "2.1.10"
},
{
"status": "affected",
"version": "2.1.11"
},
{
"status": "affected",
"version": "2.1.12"
},
{
"status": "affected",
"version": "2.1.13"
},
{
"status": "affected",
"version": "2.1.14"
},
{
"status": "affected",
"version": "2.1.15"
},
{
"status": "affected",
"version": "2.1.16"
},
{
"status": "affected",
"version": "2.1.17"
},
{
"status": "affected",
"version": "2.1.18"
},
{
"status": "affected",
"version": "2.1.19"
},
{
"status": "affected",
"version": "2.1.20"
},
{
"status": "affected",
"version": "2.1.21"
},
{
"status": "affected",
"version": "2.1.22"
},
{
"status": "affected",
"version": "2.1.23"
},
{
"status": "affected",
"version": "2.1.24"
},
{
"status": "affected",
"version": "2.1.25"
},
{
"status": "affected",
"version": "2.1.26"
},
{
"status": "affected",
"version": "2.1.27"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem000000 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:00:26.428Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431082 | NPC-Worldwide npcpy sft.py load_sft_model code injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431082"
},
{
"name": "VDB-431082 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431082/cti"
},
{
"name": "CVE-2026-122014 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-122014"
},
{
"name": "Submit #1024529 | NPC-Worldwide npcpy 2.1.18 Code Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1024529"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/NPC-Worldwide/npcpy/issues/308"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/33302468/poc.zip"
},
{
"tags": [
"product"
],
"url": "https://github.com/NPC-Worldwide/npcpy/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-04T15:37:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "NPC-Worldwide npcpy sft.py load_sft_model code injection",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-122014",
"datePublished": "2026-11-04T21:00:26.428Z",
"dateReserved": "2026-11-04T14:31:51.536Z",
"dateUpdated": "2026-11-04T21:18:23.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122015 (GCVE-0-2026-122015)
Vulnerability from cvelistv5 – Published: 2026-11-04 21:15 – Updated: 2026-11-04 21:15
VLAI
EPSS
VEX
Title
NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation
Summary
A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get_mlx_response of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely. The exploit has been made public and could be used.
Severity
CWE
- CWE-20 - Improper Input Validation
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431083 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431083/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-122015 | third-party-advisory |
| https://vuldb.com/submit/1024531 | third-party-advisory |
| https://github.com/NPC-Worldwide/npcpy/issues/309 | issue-tracking |
| https://github.com/user-attachments/files/3330258… | exploit |
| https://github.com/NPC-Worldwide/npcpy/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NPC-Worldwide | npcpy |
Affected:
2.1.0
Affected: 2.1.1 Affected: 2.1.2 Affected: 2.1.3 Affected: 2.1.4 Affected: 2.1.5 Affected: 2.1.6 Affected: 2.1.7 Affected: 2.1.8 Affected: 2.1.9 Affected: 2.1.10 Affected: 2.1.11 Affected: 2.1.12 Affected: 2.1.13 Affected: 2.1.14 Affected: 2.1.15 Affected: 2.1.16 Affected: 2.1.17 Affected: 2.1.18 Affected: 2.1.19 Affected: 2.1.20 Affected: 2.1.21 Affected: 2.1.22 Affected: 2.1.23 Affected: 2.1.24 Affected: 2.1.25 Affected: 2.1.26 Affected: 2.1.27 cpe:2.3:a:npc-worldwide:npcpy:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:npc-worldwide:npcpy:*:*:*:*:*:*:*:*"
],
"modules": [
"MLX Provider"
],
"product": "npcpy",
"vendor": "NPC-Worldwide",
"versions": [
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "2.1.1"
},
{
"status": "affected",
"version": "2.1.2"
},
{
"status": "affected",
"version": "2.1.3"
},
{
"status": "affected",
"version": "2.1.4"
},
{
"status": "affected",
"version": "2.1.5"
},
{
"status": "affected",
"version": "2.1.6"
},
{
"status": "affected",
"version": "2.1.7"
},
{
"status": "affected",
"version": "2.1.8"
},
{
"status": "affected",
"version": "2.1.9"
},
{
"status": "affected",
"version": "2.1.10"
},
{
"status": "affected",
"version": "2.1.11"
},
{
"status": "affected",
"version": "2.1.12"
},
{
"status": "affected",
"version": "2.1.13"
},
{
"status": "affected",
"version": "2.1.14"
},
{
"status": "affected",
"version": "2.1.15"
},
{
"status": "affected",
"version": "2.1.16"
},
{
"status": "affected",
"version": "2.1.17"
},
{
"status": "affected",
"version": "2.1.18"
},
{
"status": "affected",
"version": "2.1.19"
},
{
"status": "affected",
"version": "2.1.20"
},
{
"status": "affected",
"version": "2.1.21"
},
{
"status": "affected",
"version": "2.1.22"
},
{
"status": "affected",
"version": "2.1.23"
},
{
"status": "affected",
"version": "2.1.24"
},
{
"status": "affected",
"version": "2.1.25"
},
{
"status": "affected",
"version": "2.1.26"
},
{
"status": "affected",
"version": "2.1.27"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem000000 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get_mlx_response of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely. The exploit has been made public and could be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:15:18.857Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431083 | NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431083"
},
{
"name": "VDB-431083 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431083/cti"
},
{
"name": "CVE-2026-122015 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-122015"
},
{
"name": "Submit #1024531 | NPC-Worldwide npcpy 2.1.18 Improper Input Validation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1024531"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/NPC-Worldwide/npcpy/issues/309"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/33302583/poc.zip"
},
{
"tags": [
"product"
],
"url": "https://github.com/NPC-Worldwide/npcpy/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-04T15:37:14.000Z",
"value": "VulDB entry last update"
}
],
"title": "NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-122015",
"datePublished": "2026-11-04T21:15:18.857Z",
"dateReserved": "2026-11-04T14:32:02.143Z",
"dateUpdated": "2026-11-04T21:15:18.857Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122014 (GCVE-0-2026-122014)
Vulnerability from cvelistv5 – Published: 2026-11-04 21:00 – Updated: 2026-11-04 21:18
VLAI
EPSS
VEX
Title
NPC-Worldwide npcpy sft.py load_sft_model code injection
Summary
A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
AdVISE TEST Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 21:09 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431082 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431082/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-122014 | third-party-advisory |
| https://vuldb.com/submit/1024529 | third-party-advisory |
| https://github.com/NPC-Worldwide/npcpy/issues/308 | issue-tracking |
| https://github.com/user-attachments/files/3330246… | exploit |
| https://github.com/NPC-Worldwide/npcpy/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NPC-Worldwide | npcpy |
Affected:
2.1.0
Affected: 2.1.1 Affected: 2.1.2 Affected: 2.1.3 Affected: 2.1.4 Affected: 2.1.5 Affected: 2.1.6 Affected: 2.1.7 Affected: 2.1.8 Affected: 2.1.9 Affected: 2.1.10 Affected: 2.1.11 Affected: 2.1.12 Affected: 2.1.13 Affected: 2.1.14 Affected: 2.1.15 Affected: 2.1.16 Affected: 2.1.17 Affected: 2.1.18 Affected: 2.1.19 Affected: 2.1.20 Affected: 2.1.21 Affected: 2.1.22 Affected: 2.1.23 Affected: 2.1.24 Affected: 2.1.25 Affected: 2.1.26 Affected: 2.1.27 cpe:2.3:a:npc-worldwide:npcpy:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122014",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "AdVISE TEST Coordinator",
"timestamp": "2026-11-04T21:09:12.745229Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:18:23.934Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "ADP TEST CONTAINER TITLE"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:npc-worldwide:npcpy:*:*:*:*:*:*:*:*"
],
"product": "npcpy",
"vendor": "NPC-Worldwide",
"versions": [
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "affected",
"version": "2.1.1"
},
{
"status": "affected",
"version": "2.1.2"
},
{
"status": "affected",
"version": "2.1.3"
},
{
"status": "affected",
"version": "2.1.4"
},
{
"status": "affected",
"version": "2.1.5"
},
{
"status": "affected",
"version": "2.1.6"
},
{
"status": "affected",
"version": "2.1.7"
},
{
"status": "affected",
"version": "2.1.8"
},
{
"status": "affected",
"version": "2.1.9"
},
{
"status": "affected",
"version": "2.1.10"
},
{
"status": "affected",
"version": "2.1.11"
},
{
"status": "affected",
"version": "2.1.12"
},
{
"status": "affected",
"version": "2.1.13"
},
{
"status": "affected",
"version": "2.1.14"
},
{
"status": "affected",
"version": "2.1.15"
},
{
"status": "affected",
"version": "2.1.16"
},
{
"status": "affected",
"version": "2.1.17"
},
{
"status": "affected",
"version": "2.1.18"
},
{
"status": "affected",
"version": "2.1.19"
},
{
"status": "affected",
"version": "2.1.20"
},
{
"status": "affected",
"version": "2.1.21"
},
{
"status": "affected",
"version": "2.1.22"
},
{
"status": "affected",
"version": "2.1.23"
},
{
"status": "affected",
"version": "2.1.24"
},
{
"status": "affected",
"version": "2.1.25"
},
{
"status": "affected",
"version": "2.1.26"
},
{
"status": "affected",
"version": "2.1.27"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem000000 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T21:00:26.428Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431082 | NPC-Worldwide npcpy sft.py load_sft_model code injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431082"
},
{
"name": "VDB-431082 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431082/cti"
},
{
"name": "CVE-2026-122014 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-122014"
},
{
"name": "Submit #1024529 | NPC-Worldwide npcpy 2.1.18 Code Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1024529"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/NPC-Worldwide/npcpy/issues/308"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/33302468/poc.zip"
},
{
"tags": [
"product"
],
"url": "https://github.com/NPC-Worldwide/npcpy/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-04T15:37:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "NPC-Worldwide npcpy sft.py load_sft_model code injection",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-122014",
"datePublished": "2026-11-04T21:00:26.428Z",
"dateReserved": "2026-11-04T14:31:51.536Z",
"dateUpdated": "2026-11-04T21:18:23.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}