---
id: "CVE-2026-112102"
kind: "vulnerability"
aliases: ["CVE-2026-112102"]
title: "NLP.js: condition expression pipeline lets remote input inject code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@nlpjs/nlp", "fixed": [], "affected": "4.27.0", "ecosystem": "npm"}, {"name": "@nlpjs/evaluator", "fixed": [], "affected": "4.26.1", "ecosystem": "npm"}]
ecosystems: []
tags: ["code-injection", "javascript", "model-file", "nlp.js", "node", "npm", "package", "rce"]
not_affected_if: ["default-config", "no-answer-conditions", "no-model-loading", "trusted-models-only"]
published_at: "2026-10-19T10:16:46+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:41:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112102", "first_seen_at": "2026-10-23T21:57:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:41:34+00:00"}]
---

# NLP.js: condition expression pipeline lets remote input inject code

NLP.js (@nlpjs/evaluator, @nlpjs/nlp 4.27.0) compiles the 'condition' expressions in answers from a loaded model.nlp file with Function() in Node's global scope. A crafted model file runs arbitrary code with the bot process's privileges. The check that runs first treats unknown identifiers such as 'process' as undefined and never rejects them. A public PoC exists. The maintainers have not responded, and no fix is available.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@nlpjs/nlp affected 4.27.0 fixed ?
- npm:@nlpjs/evaluator affected 4.26.1 fixed ?

## How to check

- Run 'npm ls @nlpjs/evaluator @nlpjs/nlp @nlpjs/basic' and look for 4.27.0 (nlp, basic) or 4.26.1 (evaluator).
- Find where the app calls nlp.load() or auto-loads model.nlp (qna-web and Directline samples do this at boot) and whether the file can be influenced by outsiders (uploads, shared storage, downloads, a repo others can write to).
- Inspect model.nlp JSON for nlgManager.responses.*.opts.condition values other than simple comparisons.

## Fix

No patched version exists as of 2026-10-25; the issue is open and the maintainers have not responded. Until there is one: load model.nlp files only from sources you trust and control. Do not accept model files from users or untrusted locations. Remove or strip 'condition' fields from answers in models you do not generate yourself. Run the bot with least privilege.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112102
- 2026-10-25T03:41:34+00:00 analyst — Read maintainer issue axa-group/nlp.js#1380 (reporter's own writeup, open since 2026-10-03, no maintainer reply, no fix). Real vector is a malicious model.nlp file: NLG answer 'condition' strings are checked by an AST interpret pass, then compiled with Function() in Node global scope. Not arbitrary remote text input as triage implied. Public PoC linked from issue. No exploitation in the wild seen; no X search done. Severity left at high: reporter rates 8.8 for model-file delivery, CNA 5.3 to 6.3.

## Documents

- [advisory] nlp.js #1380: NLG condition expressions from model.nlp compiled with Function() (model-file RCE) https://github.com/axa-group/nlp.js/issues/1380
- [describes] VDB-421981 NLP.js 4.27.0 Evaluator.walkFunction code injection https://vuldb.com/vuln/421981
- [poc] 3em0 PoC writeup: NLP.js NLG condition precheck model-file RCE https://github.com/3em0/cve_repo/blob/main/2026/Interpreter_Differential_in_NLP.js_NLG_Condition_Precheck_Yields_Model-File_RCE.md

## From the sources

A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_