Sony nnabla EUVD-2026-109591

Exploitation requires a user to run the 'nnabla_cli encode_param' command on an attacker-controlled text-format parameter file whose contents reach the eval() call in load_param_in_txt (encode_decode_param.py). Limiting factors: it depends on that user interaction (the operator must choose to process the malicious file), affects only Sony Neural Network Libraries (nnabla) versions up to and including 1.39.0, and the affected product is no longer supported by the maintainer so no vendor fix is available. No authentication is indicated in the CVSS vector (PR:N), but the vector's AV:N 'remote' framing is undercut by the requirement to locally process the supplied file.

This is a low-priority issue by nearly every signal, with one caveat worth noting. The vendor CVSS 4.0 score is 2.1 (Low), driven by passive user interaction (UI:P) and Low impact ratings (VC:L/VI:L/VA:L), and the vuln.today decision label is 'monitor'. No CISA KEV listing is present (no active exploitation claimed) and no EPSS score is supplied, so widespread automated exploitation is not indicated. Against that, a public PoC reference is listed (GitHub) and the CVSS exploit-maturity metric is E:P (Proof-of-Concept), and the referenced PoC is titled as eval()-based 'Arbitrary Command Execution' - which conflicts with the vendor's Low VC/VI/VA impact ratings: an eval() code-injection path normally yields full arbitrary code execution (High impact), suggesting the vendor score understates technical impact. The vector also lists AV:N, but the actual trigger requires a user to process an attacker-supplied parameter file through the nnabla_cli encode_param command, which is closer to local/user-interaction exploitation than true remote network exploitation - verify the delivery assumption. Net: the real-world risk is constrained by user interaction, a niche end-of-life product, and no evidence of in-the-wild use, but the impact ceiling is higher than the 2.1 score implies.

An attacker crafts a malicious text-format parameter file embedding a Python expression in a field that load_param_in_txt passes to eval(), then induces a victim to run 'nnabla_cli encode_param' on that file. When the file is processed, the injected code executes in the context of the user running the CLI, yielding command execution. A public PoC reference exists (GitHub write-up); it is not verified here as a working weaponized exploit.