CVE-2026-120335

FARM embedding packages can load external weight files

deepset-ai · FARM WordEmbedding_LM loader

First documented disclosure · Review checkpoint

Summary

A package can source embedding weights from outside its directory.

Severity and exploitation evidence

Low · 2.4/10 · CVSS 4.0. Severity source.

Exploitation not established: Controlled loading of external canary vectors; no malicious victim established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

An unvalidated embeddings_filename becomes a local file path passed to the vector parser.

Conditions required

An attacker supplies or alters a local model package that the victim loads, with a target readable by that process.

Potential impact

Compatible vector text can become observable model weights; missing or incompatible files abort loading. This does not demonstrate arbitrary-file exfiltration, file modification or code execution.

Affected versions and configurations

CNA: through 0.8.0. Research confirms the same path in archived 0.8.1-snapshot commit 5919538.

Fix and mitigation status

No fixed release verified; upstream is archived.

Practical next steps

Migrate from the unsupported loader or enforce canonical path containment; isolate untrusted packages from host data.

Operating lesson

Model package boundaries must constrain every referenced resource.

Evidence and limits

October 6 public researcher commit; November 2 CVE publication. VulDB scores Low 2.4 CVSS 4.0 and Medium 4.8 CVSS 3.1. Local access and user interaction remain prerequisites. VulDB pages were blocked; full CNA and research were available.

Sources