{"id":"CVE-2026-116103","kind":"vulnerability","aliases":["CVE-2026-116103"],"related":[],"title":"Sony Neural Network Libraries: parameter loader lets remote input inject code","description":"A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file python/src/nnabla/utils/cli/encode_decode_param.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","summary":"nnabla (Sony Neural Network Libraries) up to and including 1.39.0, the final release, passes the first line of each .txt parameter file to Python eval() in load_param_in_txt. Running 'nnabla_cli encode_param' on a parameter folder from someone else runs their code as you. The project is end-of-life and archived, and no fix exists. A public PoC exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nnabla","fixed":[],"affected":"<= 1.39.0","ecosystem":"pypi"}],"ecosystems":[],"tags":["cli","code-injection","eol","ml-pipelines","nnabla","package","python","untrusted-model-files"],"not_affected_if":["no-cli-use","not-using-encode_param","trusted-input-only","trusted-parameter-files-only","unsupported-version-not-installed"],"how_to_check":"Run 'pip show nnabla'; any installed version (1.39.0 is the last release) is affected. Check scripts, CI and docs for 'nnabla_cli encode_param' (and decode_param) use, and whether the input directory comes from outside your team. Source check: 'eval(ds.pop(0))' in python/src/nnabla/utils/cli/encode_decode_param.py.","fix":"No upstream fix: project end-of-life (announced 2025-04-03 per researcher), repo archived, vendor did not respond. Researcher suggests replacing eval with ast.literal_eval plus integer-shape validation in a local patch. Stop using encode_param on untrusted directories, or move off nnabla.","status":"open","published_at":"2026-10-26T01:17:15+00:00","first_seen_at":"2026-10-26T01:38:48+00:00","triaged_at":"2026-10-26T01:40:53+00:00","updated_at":"2026-10-26T01:41:45+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T01:40:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Sony Neural Network Libraries: parameter loader lets remote input inject code","impact":"high","summary":"Sony Neural Network Libraries up to 1.39.0 has a flaw in the load_param_in_txt function of the encode/decode parameter command handler, where crafted input is processed as code. An attacker who can supply the parameter file or input can get code injected and run.","category":"package","nicknames":[],"who_cares":["python","nnabla","ml-pipelines"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker-supplied input injects code that runs on the host","analyst_note":"Check the NVD entry and any public exploit writeup to confirm the input path (remote or local file) and whether a fix or replacement version exists.","how_to_check":"- Check the installed version with `pip show nnabla` and look for a version at or below `1.39.0`\n- Search the project for calls to `load_param_in_txt` in `python/src/nnabla/utils/cli/encode_decode_param.py`","needs_analyst":true,"not_affected_if":["unsupported-version-not-installed","trusted-input-only"],"who_is_affected":"Teams that use Sony Neural Network Libraries (nnabla) up to 1.39.0 and run its encode/decode parameter command-line tooling on input they do not fully control. The maintainer no longer supports these versions, so no vendor patch is expected. Teams that do not use this command handler, or that run only trusted parameter files, are less exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000621,"input_tokens":3383,"output_tokens":566,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and any public exploit writeup to confirm the input path (remote or local file) and whether a fix or replacement version exists.","search":"'-116103':14A,17A '-2026':13A,16A '1.39.0':43B,109C 'affect':111C,170C 'archiv':89B 'attack':141C 'avail':147C 'cli':19B,66B 'code':11A,21B,78B,133C 'code-inject':20B 'command':127C 'compon':124C 'contact':155C 'cve':12A,15A 'disclosur':159C 'earli':156C 'els':75B 'encod':67B,125C 'end':85B 'end-of-lif':84B 'eol':23B 'eval':58B 'exist':93B,97B 'exploit':144C 'file':33B,55B,120C 'final':45B 'first':49B 'fix':92B 'folder':72B 'function':113C 'handler':128C 'identifi':101C 'includ':42B 'inject':10A,22B,134C 'input':9A 'launch':139C 'lead':131C 'let':7A 'librari':4A,38B,106C 'life':87B 'line':50B 'load':60B,114C 'loader':6A 'longer':175C 'maintain':179C 'manipul':130C 'might':149C 'ml':25B 'ml-pipelin':24B 'model':32B 'network':3A,37B,105C 'neural':2A,36B,104C 'nnabla':18A,27B,34B,65B 'packag':28B 'param':61B,68B,115C,126C 'paramet':5A,54B,71B 'pass':47B 'pipelin':26B 'poc':96B 'possibl':137C 'product':171C 'project':82B 'public':95B,146C 'python':29B,57B 'python/src/nnabla/utils/cli/encode_decode_param.py':121C 'releas':46B 'remot':8A,142C 'respond':163C 'run':64B,76B 'someon':74B 'soni':1A,35B,103C 'support':176C 'txt':53B,63B,117C 'untrust':31B 'untrusted-model-fil':30B 'use':151C 'vendor':153C 'vulner':99C,168C 'way':166C","nicknames":[],"mitigations":[],"who_affected":"Teams that use Sony Neural Network Libraries (nnabla) up to 1.39.0 and run its encode/decode parameter command-line tooling on input they do not fully control. The maintainer no longer supports these versions, so no vendor patch is expected. Teams that do not use this command handler, or that run only trusted parameter files, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T01:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-116103","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116103","severity":null,"published_at":"2026-10-26T01:17:15+00:00","modified_at":"2026-10-26T01:17:15+00:00","first_seen_at":"2026-10-26T01:38:48+00:00","fetched_at":"2026-10-26T01:38:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116103:824","url":null,"severity":null,"published_at":"2026-10-26T01:41:45+00:00","modified_at":"2026-10-26T01:41:45+00:00","first_seen_at":"2026-10-26T01:41:45+00:00","fetched_at":"2026-10-26T01:41:45+00:00","note":"NVD/VulDB plus researcher PoC writeup (3em0): eval() on first line of .txt param file in load_param_in_txt, hit via 'nnabla_cli encode_param'. Not remote service: needs victim to run CLI on an attacker-supplied dir (UI required). Project EOL, repo archived, vendor silent, no fix. PoC public, no exploitation seen. Nothing verified: no vendor text; PoC claims from third party."}],"documents":[{"id":3675,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116103","title":"NVD CVE-2026-116103","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3676,"url":"https://github.com/3em0/cve_repo/blob/main/2026/Neural-Network-Libraries-(nnabla)%E2%89%A4v1.39.0-Python-eval()-Code-Injection-in-'nnabla_cli%20encode_param'-Leading-to-Arbitrary-Command-Execution.md","title":"nnabla <=1.39.0 eval() injection in nnabla_cli encode_param (PoC writeup)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3677,"url":"https://github.com/sony/nnabla/releases","title":"sony/nnabla releases (1.39.0 final)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}