CVE-2026-122014

An npcpy fine-tuning adapter can trigger execution of model-repository code

NPC-Worldwide · npcpy supervised fine-tuning loader

First documented disclosure · Review checkpoint

Summary

A loaded adapter can select a model repository whose Python runs with the loader’s permissions.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The researcher demonstrated code execution with a marker file in a controlled environment. The report does not identify a production victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

load_sft_model reads the base-model reference from adapter metadata and enables trust_remote_code for its model and tokenizer loaders.

Conditions required

An application loads an untrusted adapter. The referenced repository contains custom Python accessible to the loading process.

Potential impact

Code can execute during model loading, before adapter weights are applied.

Affected versions and configurations

VulDB lists versions through 2.1.27. The original researcher tested 2.1.18 and identified the same loader setting in 2.1.24.

Fix and mitigation status

No issue-specific fixed release verified.

Practical next steps

Pin approved base repositories and deny executable model code from unreviewed sources. Isolate model-loading processes from credentials.

Operating lesson

Review every repository an adapter resolves before enabling executable model extensions.

Evidence and limits

The October 11 issue precedes the November 4 CVE. The separate MLX finding selects different weights without needing a Python sidecar.

Sources