CVE-2026-122014: NPC-Worldwide npcpy sft.py load_sft_model code injection
Published Nov 4, 2026
·Updated
A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function loadsftmodel of the file npcpy/ft/sft.py. The manipulation of the argument basemodelnameorpath leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Event History
Nov 4, 2026
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What versions are affected?
The issue affects NPC-Worldwide npcpy through version 2.1.27. The provided data does not identify a fixed version.
2
What must an attacker do to exploit this issue?
An attacker must be able to influence the base_model_name_or_path argument passed to load_sft_model in npcpy/ft/sft.py. Exploitation can be initiated remotely and requires user interaction according to the supplied vector.
3
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.