EUVD-2026-117114
GHSA-jv6g-mcg6-wpx7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted base_model_name_or_path value
-
ExploitUser initiates load_sft_model fine-tuning load
-
ExecutionInjected code path triggered in npcpy
-
ImpactArbitrary code execution in host process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that an application or workflow using npcpy (versions up to 2.1.27) passes attacker-influenced input into the base_model_name_or_path argument of load_sft_model in npcpy/ft/sft.py during supervised-fine-tuning model loading; the precise injection trigger is not described in the available sources. Limiting factors: the CVSS vector carries UI:P, so some user interaction (e.g. a user initiating the model load with the crafted path) is required, and because this is a fine-tuning library function, real exploitability depends entirely on whether the deploying application exposes this parameter to untrusted input - it is not exploitable against a default standalone install that never feeds untrusted data to this argument. The 'remote' characterization is unverified against the library's actual usage. |
| Impact | Low real-world priority despite the RCE/code-injection framing. The only severity signal supplied is VulDB's CVSS 4.0 base score of 2.1 (Low), driven by all-Low impact metrics (VC:L/VI:L/VA:L) and passive user interaction (UI:P), and the vuln.today decision label is 'monitor' - the lowest-urgency tier. There is no CISA KEV listing, no EPSS probability provided, and the exploit maturity is only E:P (proof-of-concept). The PoC is a reference attachment, not verified as working exploit code, so this is not confirmed active exploitation. A notable conflict exists: the description and CVSS claim remote network vector (AV:N) with 'attack can be initiated remotely,' yet the flaw is in a supervised-fine-tuning library function (load_sft_model) whose trigger depends on an application routing attacker-controlled input into the base_model_name_or_path argument - verify the remote-reachability claim with the vendor before treating it as network-exposed. Overall this reads as a low-severity, low-urgency issue in a niche library rather than a widespread threat. |
| Exploit ScenarioDerived | An attacker causes a crafted value to reach the base_model_name_or_path argument of npcpy's load_sft_model function; when a user or application initiates the model load, the injected code executes in the host process (CWE-94). A PoC archive (poc.zip) is attached to npcpy GitHub issue #308, but it is a public PoC reference and is not verified as working exploit code. The exact trigger mechanism is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 04, 2026
Code injection in NPC-Worldwide's npcpy library (versions up to and including 2.1.27) allows an attacker who can influence the base_model_name_or_path argument of load_sft_model in npcpy/ft/sft.py to execute injected code during supervised fine-tuning model loading, with the assessed impact rated high for confidentiality, integrity and availability. The CVSS 4.0 vector supplied by the reporter carries PR:N but UI:P, so the flaw is unauthenticated in the sense that no credentials are required, yet some user or application action (initiating the model load with the crafted value) is needed; the independent assessment is that real exposure depends entirely on whether a deploying application passes untrusted input into this parameter, and a public PoC reference exists but is not verified as working exploit code. There is no KEV listing and the current decision label is monitor, so this is a low real-world priority despite the RCE/code-injection framing.
RemediationAI
No vendor-released patch was identified at the time of analysis and no fixed version is named in the available sources; track the upstream issue at https://github.com/NPC-Worldwide/npcpy/issues/308 and the VulDB entry at https://vuldb.com/vuln/431082 for a fix, and upgrade to the first release that addresses it once published. Until then, the actionable control is to eliminate attacker influence over the base_model_name_or_path argument of load_sft_model: enforce a strict allowlist of known-good model identifiers or local paths before the value reaches npcpy/ft/sft.py, and reject anything containing unexpected separators, scheme prefixes or path segments. Where fine-tuning is triggered through a service or workflow, restrict who can initiate an SFT model load to trusted operators, since the assessed vector requires user interaction (UI:P) and exposure hinges on untrusted input reaching this parameter. As a backstop for the code-injection class, run fine-tuning jobs with least privilege in an isolated environment or container so that injected code cannot reach production credentials or data; this reduces blast radius but does not remove the flaw, and it adds operational overhead for model caching and GPU access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-94 (Improper Control of Generation of Code / code injection) in a Python library: npcpy's npcpy/ft/sft.py exposes load_sft_model, which consumes a base_model_name_or_path argument during supervised fine-tuning model loading. The class of weakness means untrusted content flowing into that argument can be interpreted as code or as a code-bearing artifact by the loading path rather than as inert data; the available sources do not describe the precise mechanism by which base_model_name_or_path is resolved into executable behavior, so the exact trigger remains unverified. The CPE entry cpe:2.3:a:npc-worldwide:npcpy:*:*:*:*:*:*:*:* is an unbounded wildcard, and the advisory text scopes the affected range to releases up to 2.1.27. The reporter's CVSS 4.0 score of 2.1 differs sharply from the independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which treats the flaw as a high-impact injection gated by user interaction; the low reporter score should not be read as an all-clear, and the high assessed score should not be read as proof of easy remote exploitation of a default installation, because the library only misbehaves when an application deliberately routes attacker-influenced input into this fine-tuning parameter.
Know when Npcpy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CWE-94 code injection yields code execution so C/I/A:H; the function needs no authentication (PR:N) but requires an app/user to pass the attacker-controlled model path (UI:R), and trigger details are undescribed.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB