{"id":"CVE-2026-122014","title":"NPC-Worldwide npcpy sft.py load_sft_model code injection","summary":"A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C","cvssSource":"cna","cwe":["CWE-94","CWE-74"],"vendor":"NPC-Worldwide","product":"npcpy","affected":["npcpy 2.1.0","npcpy 2.1.1","npcpy 2.1.2","npcpy 2.1.3","npcpy 2.1.4","npcpy 2.1.5","npcpy 2.1.6","npcpy 2.1.7","npcpy 2.1.8","npcpy 2.1.9","npcpy 2.1.10","npcpy 2.1.11","npcpy 2.1.12","npcpy 2.1.13","npcpy 2.1.14","npcpy 2.1.15","npcpy 2.1.16","npcpy 2.1.17","npcpy 2.1.18","npcpy 2.1.19","npcpy 2.1.20","npcpy 2.1.21","npcpy 2.1.22","npcpy 2.1.23","npcpy 2.1.24","npcpy 2.1.25","npcpy 2.1.26","npcpy 2.1.27"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-04T21:09:12.745229Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T21:18:23.934Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-122014","references":[{"url":"https://vuldb.com/vuln/431082","label":"VDB-431082 | NPC-Worldwide npcpy sft.py load_sft_model code injection"},{"url":"https://vuldb.com/vuln/431082/cti","label":"VDB-431082 | CTI Indicators (IOB, IOC, TTP, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-122014","label":"CVE-2026-122014 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1024529","label":"Submit #1024529 | NPC-Worldwide npcpy 2.1.18  Code Injection"},{"url":"https://github.com/NPC-Worldwide/npcpy/issues/308"},{"url":"https://github.com/user-attachments/files/33302468/poc.zip"},{"url":"https://github.com/NPC-Worldwide/npcpy/"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.609Z","epss":0.00306,"epssPercentile":0.23552,"slug":"CVE-2026-122014","body":"## Overview\n\nA vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.\n\n## Affected\n\n- `npcpy 2.1.0`\n- `npcpy 2.1.1`\n- `npcpy 2.1.2`\n- `npcpy 2.1.3`\n- `npcpy 2.1.4`\n- `npcpy 2.1.5`\n- `npcpy 2.1.6`\n- `npcpy 2.1.7`\n- `npcpy 2.1.8`\n- `npcpy 2.1.9`\n- `npcpy 2.1.10`\n- `npcpy 2.1.11`\n- `npcpy 2.1.12`\n- `npcpy 2.1.13`\n- `npcpy 2.1.14`\n- `npcpy 2.1.15`\n- `npcpy 2.1.16`\n- `npcpy 2.1.17`\n- `npcpy 2.1.18`\n- `npcpy 2.1.19`\n- `npcpy 2.1.20`\n- `npcpy 2.1.21`\n- `npcpy 2.1.22`\n- `npcpy 2.1.23`\n- `npcpy 2.1.24`\n- `npcpy 2.1.25`\n- `npcpy 2.1.26`\n- `npcpy 2.1.27`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}