CVE-2026-120335 deepset-ai farm Model Package Loader language_model.py WordEmbedding_LM.load path traversal

A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbeddingLM.load of the file farm/modeling/languagemodel.py of the component Model Package Loader. The manipulation of the argument embeddingsfilename leads to path traversal. An attack has to be approache...