Vulnerability · Published Nov 4, 2026 · Assigned by VulDB
CVE-2026-122014NPC-Worldwide npcpy sft.py load_sft_model code injection
Medium 6.3
In plain English
A medium-severity code injection in npcpy from NPC-Worldwide. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 76.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NPC-Worldwide | npcpy | 2.1.02.1.12.1.22.1.32.1.42.1.52.1.62.1.7 |
Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
References
- VDB-431082 | NPC-Worldwide npcpy sft.py load_sft_model code injection vdb-entry, technical-description
- VDB-431082 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-122014 | CVE Analysis and Report third-party-advisory
- Submit #1024529 | NPC-Worldwide npcpy 2.1.18 Code Injection third-party-advisory
- https://github.com/NPC-Worldwide/npcpy/issues/308 issue-tracking
- https://github.com/user-attachments/files/33302468/poc.zip exploit
- https://github.com/NPC-Worldwide/npcpy/ product