CVE-2026-122014
LOW
INFO
Priority: 0.01
BB Relevance:
54/100
Published: 2026-11-04
Modified: 2026-11-10
First seen: 2026-11-04
Status: active
Attack Surface
Network
Low Complexity
No Auth
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Passive
S:
X
AT:
None
VC:
Low
VI:
Low
VA:
Low
Description
A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected Software (84)
| Vendor | Product | Version |
|---|---|---|
| NPC-Worldwide | npcpy | 2.1.0 |
| NPC-Worldwide | npcpy | 2.1.1 |
| NPC-Worldwide | npcpy | 2.1.2 |
| NPC-Worldwide | npcpy | 2.1.3 |
| NPC-Worldwide | npcpy | 2.1.4 |
| NPC-Worldwide | npcpy | 2.1.5 |
| NPC-Worldwide | npcpy | 2.1.6 |
| NPC-Worldwide | npcpy | 2.1.7 |
| NPC-Worldwide | npcpy | 2.1.8 |
| NPC-Worldwide | npcpy | 2.1.9 |
| NPC-Worldwide | npcpy | 2.1.10 |
| NPC-Worldwide | npcpy | 2.1.11 |
| NPC-Worldwide | npcpy | 2.1.12 |
| NPC-Worldwide | npcpy | 2.1.13 |
| NPC-Worldwide | npcpy | 2.1.14 |
| NPC-Worldwide | npcpy | 2.1.15 |
| NPC-Worldwide | npcpy | 2.1.16 |
| NPC-Worldwide | npcpy | 2.1.17 |
| NPC-Worldwide | npcpy | 2.1.18 |
| NPC-Worldwide | npcpy | 2.1.19 |
| NPC-Worldwide | npcpy | 2.1.20 |
| NPC-Worldwide | npcpy | 2.1.21 |
| NPC-Worldwide | npcpy | 2.1.22 |
| NPC-Worldwide | npcpy | 2.1.23 |
| NPC-Worldwide | npcpy | 2.1.24 |
| NPC-Worldwide | npcpy | 2.1.25 |
| NPC-Worldwide | npcpy | 2.1.26 |
| NPC-Worldwide | npcpy | 2.1.27 |
| NPC-Worldwide | npcpy | 2.1.0 |
| NPC-Worldwide | npcpy | 2.1.1 |
Showing 30 of 84 entries