---
id: "CVE-2026-116103"
kind: "vulnerability"
aliases: ["CVE-2026-116103"]
title: "Sony Neural Network Libraries: parameter loader lets remote input inject code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "nnabla", "fixed": [], "affected": "<= 1.39.0", "ecosystem": "pypi"}]
ecosystems: []
tags: ["cli", "code-injection", "eol", "ml-pipelines", "nnabla", "package", "python", "untrusted-model-files"]
not_affected_if: ["no-cli-use", "not-using-encode_param", "trusted-input-only", "trusted-parameter-files-only", "unsupported-version-not-installed"]
published_at: "2026-10-26T01:17:15+00:00"
first_seen_at: "2026-10-26T01:38:48+00:00"
updated_at: "2026-10-26T01:41:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116103", "first_seen_at": "2026-10-26T01:38:48+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-26T01:41:45+00:00"}]
---

# Sony Neural Network Libraries: parameter loader lets remote input inject code

nnabla (Sony Neural Network Libraries) up to and including 1.39.0, the final release, passes the first line of each .txt parameter file to Python eval() in load_param_in_txt. Running 'nnabla_cli encode_param' on a parameter folder from someone else runs their code as you. The project is end-of-life and archived, and no fix exists. A public PoC exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:nnabla affected <= 1.39.0 fixed ?

## How to check

Run 'pip show nnabla'; any installed version (1.39.0 is the last release) is affected. Check scripts, CI and docs for 'nnabla_cli encode_param' (and decode_param) use, and whether the input directory comes from outside your team. Source check: 'eval(ds.pop(0))' in python/src/nnabla/utils/cli/encode_decode_param.py.

## Fix

No upstream fix: project end-of-life (announced 2025-04-03 per researcher), repo archived, vendor did not respond. Researcher suggests replacing eval with ast.literal_eval plus integer-shape validation in a local patch. Stop using encode_param on untrusted directories, or move off nnabla.

## Timeline

- 2026-10-26T01:38:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116103
- 2026-10-26T01:41:45+00:00 analyst — NVD/VulDB plus researcher PoC writeup (3em0): eval() on first line of .txt param file in load_param_in_txt, hit via 'nnabla_cli encode_param'. Not remote service: needs victim to run CLI on an attacker-supplied dir (UI required). Project EOL, repo archived, vendor silent, no fix. PoC public, no exploitation seen. Nothing verified: no vendor text; PoC claims from third party.

## Documents

- [advisory] NVD CVE-2026-116103 https://nvd.nist.gov/vuln/detail/CVE-2026-116103
- [mentions] sony/nnabla releases (1.39.0 final) https://github.com/sony/nnabla/releases
- [poc] nnabla <=1.39.0 eval() injection in nnabla_cli encode_param (PoC writeup) https://github.com/3em0/cve_repo/blob/main/2026/Neural-Network-Libraries-(nnabla)%E2%89%A4v1.39.0-Python-eval()-Code-Injection-in-'nnabla_cli%20encode_param'-Leading-to-Arbitrary-Command-Execution.md

## From the sources

A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file python/src/nnabla/utils/cli/encode_decode_param.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_