CVE-2026-120334

FARM tokenizer metadata can read outside a model package

deepset-ai · FARM EmbeddingTokenizer loader

First documented disclosure · Review checkpoint

Summary

A model package can redirect vocabulary loading to a readable local file.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: Controlled local loading with marker files; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The loader joins an untrusted vocab_filename to the package path without checking containment; absolute paths can replace the base.

Conditions required

A user or service loads an attacker-supplied package through the embedding tokenizer path.

Potential impact

Local file contents enter tokenizer state; disclosure outside the process depends on later export or exposure. Incompatible vocabulary files can abort loading; no code execution demonstrated.

Affected versions and configurations

CNA: through 0.8.0. Research also verified archived 0.8.1-snapshot commit 5919538.

Fix and mitigation status

No fixed release verified; upstream is archived.

Practical next steps

Retire or patch the unsupported loader; constrain resolved paths to the package root and isolate loading from sensitive files.

Operating lesson

Data-only model metadata still controls a filesystem security boundary.

Evidence and limits

Public researcher commit October 6 precedes November 2 CVE publication. VulDB scores Medium 5.3 CVSS 4.0; its remote vector still requires package loading. VulDB web pages were inaccessible, but full CNA and original research were reviewed.

Sources