CVE-2026-122015

An npcpy MLX adapter can replace the model used for responses

NPC-Worldwide · npcpy MLX response provider

First documented disclosure · Review checkpoint

Summary

An adapter can redirect the loader to an attacker-selected model and tokenizer.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The researcher compared inert adapters in a controlled MLX setup. The demonstrated substitution required no executable Python sidecar. Malicious exploitation is unestablished.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

get_mlx_response trusts a nonempty base-model name from a local adapter and passes it to the MLX loader without verifying it against the operator’s selection.

Conditions required

The application uses the MLX provider with an untrusted LoRA adapter, and the named base model is available from a Hub or local cache.

Potential impact

The selected weights control generated responses. Effects on connected tools depend on how the application uses those responses.

Affected versions and configurations

VulDB lists versions through 2.1.27. The researcher tested the code at 2.1.18.

Fix and mitigation status

No verified fixed release.

Practical next steps

Verify that the adapter names the approved immutable base model before loading any weights or tokenizer.

Operating lesson

Model identity is an input to authorization when generated responses can trigger tools.

Evidence and limits

The October 11 public issue is earlier than the November 4 CVE. This entry covers model substitution, distinct from code execution in npcpy’s supervised fine-tuning loader.

Sources