CVE-2026-126995

A model index could load weights from outside its package

Jlama maintainers · Jlama SafeTensors weight loader

First documented disclosure · Review checkpoint

Summary

The weight loader did not keep each referenced file within the model directory. The application could read tensor data from outside the intended package.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The CNA reports that a demonstration is public. It does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The weight loader did not keep each referenced file within the model directory.

Conditions required

A Jlama application loaded an untrusted model package. The referenced files had to be accessible to its operating-system account.

Potential impact

The application could read tensor data from outside the intended package.

Affected versions and configurations

The CNA lists 0.8.0–0.8.4 and 0.9.0-beta.

Fix and mitigation status

No fixed release is identified in the CNA record.

Practical next steps

Confine the model-loading process and accept only trusted model packages pending a verified fix.

Operating lesson

Check the authority granted to the affected component against the operation a user expects.

Evidence and limits

The public project issue dates to October 17. The CNA published on November 12 and identifies no corrected build. The public disclosure was on 2026-10-17. The CVE record was published on 2026-11-12.

Sources