CVE-2026-122014
NPC-Worldwide npcpy sft.py load_sft_model code injection
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
| CWE | CWE-94 CWE-74 |
| Vendor | npc-worldwide |
| Product | npcpy |
| Published | Nov 4, 2026 |
| Last Updated | Nov 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for npc-worldwide npcpy
Be the first to know when new medium vulnerabilities affecting npc-worldwide npcpy are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
NPC-Worldwide / npcpy
2.1.0 2.1.1 2.1.2 2.1.3 2.1.4 2.1.5 2.1.6 2.1.7 2.1.8 2.1.9 2.1.10 2.1.11 2.1.12 2.1.13 2.1.14 2.1.15 2.1.16 2.1.17 2.1.18 2.1.19 2.1.20 2.1.21 2.1.22 2.1.23 2.1.24 2.1.25 2.1.26 2.1.27
References
vuldb.com: https://vuldb.com/vuln/431082 vuldb.com: https://vuldb.com/vuln/431082/cti vuldb.com: https://vuldb.com/cve/CVE-2026-122014 vuldb.com: https://vuldb.com/submit/1024529 github.com: https://github.com/NPC-Worldwide/npcpy/issues/308 github.com: https://github.com/user-attachments/files/33302468/poc.zip github.com: https://github.com/NPC-Worldwide/npcpy/
Credits
🔍 Dem000000 (VulDB User)