CVE-2026-122015: NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation
A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function getmlxresponse of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely. The exploit has been made public and could be used.
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects NPC-Worldwide npcpy through version 2.1.27, specifically the MLX Provider's get_mlx_response function in npcpy/gen/response.py.
What does an attacker need to exploit this issue?
The issue can be launched remotely and does not require privileges, but it requires user interaction according to the provided vector. Exploitation involves manipulating the model argument supplied to get_mlx_response.
Is public exploit information available?
Yes. The available data states that an exploit has been made public and could be used.