RCE in Npc-Worldwide Npcpy
CVE-2026-122014
A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.003 (23.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 24th percentile — 23.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
- Npc-Worldwide Npcpy — versions 2.1.0, 2.1.1, 2.1.10
Weakness classification (CWE)
References
- github.com/NPC-Worldwide/npcpy/ (product)
- github.com/NPC-Worldwide/npcpy/issues/308 (issue-tracking)
- github.com/user-attachments/files/33302468/poc.zip (exploit)
- vuldb.com/cve/CVE-2026-122014 (third-party-advisory)
- vuldb.com/submit/1024529 (third-party-advisory)
- vuldb.com/vuln/431082 (technical-description, vdb-entry)
- vuldb.com/vuln/431082/cti (signature, permissions-required)
Frequently asked questions
- What is CVE-2026-122014?
- CVE-2026-122014 is a medium-severity vulnerability in Npc-Worldwide Npcpy, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 6.3/10. Published 2026-11-04.
- How severe is CVE-2026-122014?
- Medium severity. CVSS v3 base score is 6.3 out of 10.