npcpy CVE-2026-122015

Exploitation requires that the deploying application use npcpy's MLX provider path and allow an externally-influenced value to reach the 'model' argument of get_mlx_response; because MLX is Apple's framework, this realistically means an Apple-silicon/macOS deployment running npcpy ≤ 2.1.27. The CVSS vector requires passive user interaction (UI:P), so an attacker cannot trigger it fully unassisted - some user-driven action is needed to reach the vulnerable call. No authentication is indicated (PR:N), so no credentials are required, but the limiting factors are the niche MLX code path, the need for the application to pass untrusted input into the 'model' parameter, and the required user interaction. The precise trigger (what malformed model value causes the failure and what it produces) is not described in the available sources.

Signals point to a genuine-but-moderate issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L) yields a 5.3 medium score: network-reachable, low complexity and no privileges, but gated by passive user interaction (UI:P) and limited to low confidentiality, integrity and availability impact with no scope change. No EPSS probability is supplied in the input, and the CVE is NOT on CISA KEV, so there is no evidence of active or widespread exploitation. The exploit maturity is E:P (proof-of-concept), and the attached PoC is a reference (poc.zip on GitHub issue #309) that is not verified as working exploit code - this must not be read as confirmed weaponization. The vuln.today decision label is 'this_month', consistent with a plan-and-patch cadence rather than act_now. The single-source origin (VulDB) and absence of a vendor advisory are the main uncertainties. Net: a real but low-to-moderate priority finding in a niche open-source library, not a high-CVSS-but-illusory issue and not a drop-everything emergency.

A developer integrates npcpy and exposes a code path that forwards an attacker-influenced 'model' value into get_mlx_response in the MLX provider; an attacker remotely supplies a crafted model argument that is not properly validated. Exploitation requires user interaction (UI:P) to reach the vulnerable call, and the resulting impact is limited (low confidentiality/integrity/availability). A public PoC reference (poc.zip) exists but is not verified as working exploit code.