deepset-ai FARM CVE-2026-120335

Exploitation requires local access to a host running deepset-ai FARM (versions up to 0.8.0) and the ability to control the embeddings_filename argument of the WordEmbedding_LM.load function in farm/modeling/language_model.py - typically by supplying a crafted/untrusted model package to the Model Package Loader. Limiting factors per the CVSS vector: the attack is local only (AV:L), requires an already-authenticated low-privilege account (PR:L), and requires user interaction (UI:P), i.e. a victim must actually load the attacker-influenced input; it cannot be triggered remotely or unauthenticated. The product is also end-of-life/unsupported, so affected deployments are limited to legacy installations.

This is a low-priority issue despite being a real, disclosed flaw. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P) scores just 0.9 and describes a locally-exploitable path traversal (CWE-22) in deepset-ai FARM's WordEmbedding_LM.load that requires local access, existing low-level privileges (PR:L), and user interaction (UI:P) to trigger - all of which sharply constrain real-world risk. The vuln.today decision label is 'monitor', not an actionable/urgent tier, and there is no CISA KEV listing and no EPSS score provided, so there is no signal of active or probable exploitation. A PoC reference exists on GitHub but it is a reference only and is not verified as working exploit code, so POC availability must not be read as active exploitation. Compounding the low urgency: the advisory states the affected product is no longer supported by the maintainer, and the vendor did not respond to the disclosure. The only intelligence source is VulDB, so all metrics are single-sourced and unverified by the vendor or NVD. Net: a genuine but low-severity, local, privilege-and-interaction-gated flaw in a retired niche ML library - monitor rather than prioritize.

A local, low-privileged user who can influence the embeddings_filename argument passed to WordEmbedding_LM.load - for example by supplying a crafted model package to a FARM-based pipeline - causes the loader to traverse outside the intended directory. A public PoC reference exists but is not verified as working exploit code, and exploitation still requires local access plus the victim loading the attacker-influenced input (UI:P).