---
id: CVE-2026-122015
title: NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation
summary: >-
  A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This
  vulnerability affects the function get_mlx_response of the file
  npcpy/gen/response.py of the component MLX Provider. The manipulation of the
  argument model results in im…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-20
vendor: NPC-Worldwide
product: npcpy
affected:
  - npcpy 2.1.0
  - npcpy 2.1.1
  - npcpy 2.1.2
  - npcpy 2.1.3
  - npcpy 2.1.4
  - npcpy 2.1.5
  - npcpy 2.1.6
  - npcpy 2.1.7
  - npcpy 2.1.8
  - npcpy 2.1.9
  - npcpy 2.1.10
  - npcpy 2.1.11
  - npcpy 2.1.12
  - npcpy 2.1.13
  - npcpy 2.1.14
  - npcpy 2.1.15
  - npcpy 2.1.16
  - npcpy 2.1.17
  - npcpy 2.1.18
  - npcpy 2.1.19
  - npcpy 2.1.20
  - npcpy 2.1.21
  - npcpy 2.1.22
  - npcpy 2.1.23
  - npcpy 2.1.24
  - npcpy 2.1.25
  - npcpy 2.1.26
  - npcpy 2.1.27
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T21:15:18.857Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122015'
references:
  - url: 'https://vuldb.com/vuln/431083'
    label: >-
      VDB-431083 | NPC-Worldwide npcpy MLX Provider response.py get_mlx_response
      input validation
  - url: 'https://vuldb.com/vuln/431083/cti'
    label: 'VDB-431083 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-122015'
    label: CVE-2026-122015 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1024531'
    label: 'Submit #1024531 | NPC-Worldwide npcpy 2.1.18 Improper Input Validation'
  - url: 'https://github.com/NPC-Worldwide/npcpy/issues/309'
  - url: 'https://github.com/user-attachments/files/33302583/poc.zip'
  - url: 'https://github.com/NPC-Worldwide/npcpy/'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.611Z'
epss: 0.00312
epssPercentile: 0.24209
---

## Overview

A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get_mlx_response of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely. The exploit has been made public and could be used.

## Affected

- `npcpy 2.1.0`
- `npcpy 2.1.1`
- `npcpy 2.1.2`
- `npcpy 2.1.3`
- `npcpy 2.1.4`
- `npcpy 2.1.5`
- `npcpy 2.1.6`
- `npcpy 2.1.7`
- `npcpy 2.1.8`
- `npcpy 2.1.9`
- `npcpy 2.1.10`
- `npcpy 2.1.11`
- `npcpy 2.1.12`
- `npcpy 2.1.13`
- `npcpy 2.1.14`
- `npcpy 2.1.15`
- `npcpy 2.1.16`
- `npcpy 2.1.17`
- `npcpy 2.1.18`
- `npcpy 2.1.19`
- `npcpy 2.1.20`
- `npcpy 2.1.21`
- `npcpy 2.1.22`
- `npcpy 2.1.23`
- `npcpy 2.1.24`
- `npcpy 2.1.25`
- `npcpy 2.1.26`
- `npcpy 2.1.27`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.