{"id":"CVE-2026-112102","kind":"vulnerability","aliases":["CVE-2026-112102"],"related":[],"title":"NLP.js: condition expression pipeline lets remote input inject code","description":"A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"NLP.js (@nlpjs/evaluator, @nlpjs/nlp 4.27.0) compiles the 'condition' expressions in answers from a loaded model.nlp file with Function() in Node's global scope. A crafted model file runs arbitrary code with the bot process's privileges. The check that runs first treats unknown identifiers such as 'process' as undefined and never rejects them. A public PoC exists. The maintainers have not responded, and no fix is available.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@nlpjs/nlp","fixed":[],"affected":"4.27.0","ecosystem":"npm"},{"name":"@nlpjs/evaluator","fixed":[],"affected":"4.26.1","ecosystem":"npm"}],"ecosystems":[],"tags":["code-injection","javascript","model-file","nlp.js","node","npm","package","rce"],"not_affected_if":["default-config","no-answer-conditions","no-model-loading","trusted-models-only"],"how_to_check":"- Run 'npm ls @nlpjs/evaluator @nlpjs/nlp @nlpjs/basic' and look for 4.27.0 (nlp, basic) or 4.26.1 (evaluator).\n- Find where the app calls nlp.load() or auto-loads model.nlp (qna-web and Directline samples do this at boot) and whether the file can be influenced by outsiders (uploads, shared storage, downloads, a repo others can write to).\n- Inspect model.nlp JSON for nlgManager.responses.*.opts.condition values other than simple comparisons.","fix":"No patched version exists as of 2026-10-25; the issue is open and the maintainers have not responded. Until there is one: load model.nlp files only from sources you trust and control. Do not accept model files from users or untrusted locations. Remove or strip 'condition' fields from answers in models you do not generate yourself. Run the bot with least privilege.","status":"open","published_at":"2026-10-19T10:16:46+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:23:16+00:00","updated_at":"2026-10-25T03:41:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:23:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"NLP.js: condition expression pipeline lets remote input inject code","impact":"high","summary":"NLP.js 4.27.0 has a flaw in the Evaluator.walkFunction function, which processes the condition argument in its condition expression pipeline. A remote attacker can supply crafted input that results in code injection, and a public exploit exists.","category":"package","nicknames":[],"who_cares":["nlp.js","node","javascript"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs injected code on the server","analyst_note":"Find the upstream fix or patched version and confirm whether the condition evaluator is reachable with untrusted input; check the NVD page and the project's issue tracker.","how_to_check":"- Check the installed NLP.js version with `npm ls @nlpjs/core` or `npm ls nlp.js` and look for `4.27.0`\n- Search the codebase for calls to the condition evaluator in packages/evaluator (Evaluator.walkFunction) that receive untrusted input","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Applications that run NLP.js 4.27.0 and pass user-controlled text into its condition expression evaluation are exposed. Projects that do not use the condition evaluator or that do not run this version can skip it. The sources do not name a patched version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000594,"input_tokens":3349,"output_tokens":519,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the upstream fix or patched version and confirm whether the condition evaluator is reachable with untrusted input; check the NVD page and the project's issue tracker.","search":"'-112102':12A,15A '-2026':11A,14A '4.27.0':33B,104C 'answer':39B 'arbitrari':57B 'argument':124C 'attack':136C 'avail':95B 'axa':101C 'bot':61B 'check':66B 'code':9A,19B,58B,128C 'code-inject':18B 'compil':34B 'compon':116C 'condit':2A,36B,117C,125C 'craft':53B 'cve':10A,13A 'detect':99C 'earli':154C 'evaluator.walkfunction':109C 'exist':85B 'exploit':139C 'express':3A,37B,118C 'file':24B,44B,55B,112C 'first':69B 'fix':93B 'function':46B,108C 'global':50B 'group':102C 'identifi':72B 'impact':106C 'inform':150C 'inject':8A,20B,129C 'input':7A 'issu':157C 'javascript':21B 'launch':134C 'let':5A 'load':42B 'maintain':87B 'manipul':121C 'may':144C 'model':23B,54B 'model-fil':22B 'model.nlp':43B 'never':79B 'nlp.js':1A,25B,30B,103C 'nlpjs/evaluator':17A,31B 'nlpjs/nlp':16A,32B 'node':26B,48B 'npm':27B 'packag':28B 'packages/evaluator/src/evaluator.js':113C 'pipelin':4A,119C 'poc':84B 'possibl':132C 'privileg':64B 'problem':153C 'process':62B,75B 'project':148C 'public':83B,142C 'rce':29B 'reject':80B 'remot':6A,137C 'report':158C 'respond':90B,162C 'result':126C 'run':56B,68B 'scope':51B 'treat':70B 'undefin':77B 'unknown':71B 'use':146C 'vulner':97C 'yet':163C","nicknames":[],"mitigations":[],"who_affected":"Apps that load a model.nlp file an outsider can alter or supply (uploaded models, shared or downloaded models, writable storage) and use NLP.js 4.27.0 with the NLG manager and the Evaluator service (the @nlpjs/basic plugin registers it). A malicious model gets code execution as the bot process while the bot keeps answering normally. Apps that train and load only their own trusted models, or that never use answer conditions, are at much lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-112102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112102","severity":null,"published_at":"2026-10-19T10:16:46+00:00","modified_at":"2026-10-19T17:17:12+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112102:771","url":null,"severity":null,"published_at":"2026-10-25T03:41:34+00:00","modified_at":"2026-10-25T03:41:34+00:00","first_seen_at":"2026-10-25T03:41:34+00:00","fetched_at":"2026-10-25T03:41:34+00:00","note":"Read maintainer issue axa-group/nlp.js#1380 (reporter's own writeup, open since 2026-10-03, no maintainer reply, no fix). Real vector is a malicious model.nlp file: NLG answer 'condition' strings are checked by an AST interpret pass, then compiled with Function() in Node global scope. Not arbitrary remote text input as triage implied. Public PoC linked from issue. No exploitation in the wild seen; no X search done. Severity left at high: reporter rates 8.8 for model-file delivery, CNA 5.3 to 6.3."}],"documents":[{"id":3289,"url":"https://github.com/axa-group/nlp.js/issues/1380","title":"nlp.js #1380: NLG condition expressions from model.nlp compiled with Function() (model-file RCE)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3290,"url":"https://vuldb.com/vuln/421981","title":"VDB-421981 NLP.js 4.27.0 Evaluator.walkFunction code injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3291,"url":"https://github.com/3em0/cve_repo/blob/main/2026/Interpreter_Differential_in_NLP.js_NLG_Condition_Precheck_Yields_Model-File_RCE.md","title":"3em0 PoC writeup: NLP.js NLG condition precheck model-file RCE","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}