CVE-2026-122014 | NPC-Worldwide npcpy up to 2.1.27 npcpy/ft/sft.py load_sft_model base_model_name_or_path code injection (Issue 308)

November 4, 2026 Yanac

A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. It has been rated as critical. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection.

This vulnerability is documented as CVE-2026-122014. The attack can be initiated remotely. Additionally, an exploit exists.VulDB Recent EntriesRead More