Description
A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NPC-Worldwide | npcpy | 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.1.10, 2.1.11, 2.1.12, 2.1.13, 2.1.14, 2.1.15, 2.1.16, 2.1.17, 2.1.18, 2.1.19, 2.1.20, 2.1.21, 2.1.22, 2.1.23, 2.1.24, 2.1.25, 2.1.26, 2.1.27 | — |
References
- VDB-431082 | NPC-Worldwide npcpy sft.py load_sft_model code injection vdb-entry technical-description
- VDB-431082 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-122014 | CVE Analysis and Report third-party-advisory
- Submit #1024529 | NPC-Worldwide npcpy 2.1.18 Code Injection third-party-advisory
- https://github.com/NPC-Worldwide/npcpy/issues/308 issue-tracking
- https://github.com/user-attachments/files/33302468/poc.zip exploit
- https://github.com/NPC-Worldwide/npcpy/ product