CVE-2026-122014

A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function loadsftmodel of the file npcpy/ft/sft.py. The manipulation of the argument basemodelnameorpath leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public...

CVE-2026-122014 NPC-Worldwide npcpy sft.py load_sft_model code injection

A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function loadsftmodel of the file npcpy/ft/sft.py. The manipulation of the argument basemodelnameorpath leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public...

CVE-2026-122014

A code injection vulnerability exists in NPC-Worldwide npcpy versions up to 2.1.27 . The flaw is located in the load_sft_model function within the npcpy/ft/sft.py file, where manipulating the base_model_name_or_path argument allows for remote execution. The exploit has been disclosed to the publi...

EUVD-2026-117114

A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function loadsftmodel of the file npcpy/ft/sft.py. The manipulation of the argument basemodelnameorpath leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public...