CVE-2026-122015

MEDIUM 6.3

NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get_mlx_response of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely. The exploit has been made public and could be used.

CWE	CWE-20
Vendor	npc-worldwide
Product	npcpy
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for npc-worldwide npcpy

Be the first to know when new medium vulnerabilities affecting npc-worldwide npcpy are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

NPC-Worldwide / npcpy

2.1.0 2.1.1 2.1.2 2.1.3 2.1.4 2.1.5 2.1.6 2.1.7 2.1.8 2.1.9 2.1.10 2.1.11 2.1.12 2.1.13 2.1.14 2.1.15 2.1.16 2.1.17 2.1.18 2.1.19 2.1.20 2.1.21 2.1.22 2.1.23 2.1.24 2.1.25 2.1.26 2.1.27

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/431083 vuldb.com: https://vuldb.com/vuln/431083/cti vuldb.com: https://vuldb.com/cve/CVE-2026-122015 vuldb.com: https://vuldb.com/submit/1024531 github.com: https://github.com/NPC-Worldwide/npcpy/issues/309 github.com: https://github.com/user-attachments/files/33302583/poc.zip github.com: https://github.com/NPC-Worldwide/npcpy/

Credits

🔍 Dem000000 (VulDB User)