CVE-2026-126995 | tjake Jlama up to 0.8.4/0.9.0-beta SafeTensorIndex.java SafeTensorIndex.loadWeights weight_map path traversal (Issue 211)

November 12, 2026 Yanac

A vulnerability marked as critical has been reported in tjake Jlama up to 0.8.4/0.9.0-beta. Affected by this vulnerability is the function SafeTensorIndex.loadWeights of the file jlama-core/src/main/java/com/github/tjake/jlama/safetensors/SafeTensorIndex.java. Performing a manipulation of the argument weight_map results in path traversal.

This vulnerability was named CVE-2026-126995. The attack may be initiated remotely. In addition, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More