CVE-2026-122014

A flaw was found in npcpy. An input validation vulnerability in the model loading component allows a remote attacker to execute arbitrary code. By supplying a specially crafted model name or path parameter, an attacker can inject and execute unintended commands within the application's runtime...

EUVD-2026-117123

A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function getmlxresponse of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely...

CVE-2026-122015

A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function getmlxresponse of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely...

CVE-2026-122014

A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function loadsftmodel of the file npcpy/ft/sft.py. The manipulation of the argument basemodelnameorpath leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public...

CVE-2026-122015

A vulnerability exists in NPC-Worldwide npcpy versions up to 2.1.27 within the MLX Provider component. The issue is located in the get_mlx_response function of the npcpy/gen/response.py file, where manipulation of the model argument leads to improper input validation (CWE-20). This vulnerability ...

CVE-2026-122015 NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation

A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function getmlxresponse of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely...

CVE-2026-122014 NPC-Worldwide npcpy sft.py load_sft_model code injection

A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function loadsftmodel of the file npcpy/ft/sft.py. The manipulation of the argument basemodelnameorpath leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public...

CVE-2026-122014

A code injection vulnerability exists in NPC-Worldwide npcpy versions up to 2.1.27 . The flaw is located in the load_sft_model function within the npcpy/ft/sft.py file, where manipulating the base_model_name_or_path argument allows for remote execution. The exploit has been disclosed to the publi...

EUVD-2026-117114

A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function loadsftmodel of the file npcpy/ft/sft.py. The manipulation of the argument basemodelnameorpath leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public...

CVE-2026-122014 NPC-Worldwide npcpy sft.py load_sft_model code injection

A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function loadsftmodel of the file npcpy/ft/sft.py. The manipulation of the argument basemodelnameorpath leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public...

PT-2026-137175

A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get mlx response of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely...

PT-2026-137148

A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load sft model of the file npcpy/ft/sft.py. The manipulation of the argument base model name or path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the...