CVE-2026-120334

MEDIUM 4.3

deepset-ai farm Tokenizer Loader tokenization.py EmbeddingTokenizer.from_pretrained path traversal

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.from_pretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocab_filename can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CWE	CWE-22
Vendor	deepset-ai
Product	farm
Published	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for deepset-ai farm

Be the first to know when new medium vulnerabilities affecting deepset-ai farm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

deepset-ai / farm

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/429659 vuldb.com: https://vuldb.com/vuln/429659/cti vuldb.com: https://vuldb.com/cve/CVE-2026-120334 vuldb.com: https://vuldb.com/submit/1016276 github.com: https://github.com/3em0/cve_repo/blob/main/2026/Path_Traversal_in_FARM_Tokenizer_Load_via_Attacker-Controlled_vocab_filename.md

Credits

🔍 Dem0000000 (VulDB User) VulDB CNA Team