{"id":"CVE-2026-120334","kind":"vulnerability","aliases":["CVE-2026-120334"],"related":[],"title":"deepset FARM: tokenizer loader lets remote requests traverse file paths","description":"A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.from_pretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocab_filename can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","summary":"deepset FARM up to version 0.8.0 has a path traversal flaw in EmbeddingTokenizer.from_pretrained, where a manipulated vocab_filename argument is not restricted. A remote attacker can use it to reach files outside the intended directory, and a public exploit has been published.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["farm","nlp","package","python"],"not_affected_if":[],"how_to_check":"- Check whether the installed FARM version is `0.8.0` or lower.\n- Look for calls to `EmbeddingTokenizer.from_pretrained` that pass user-supplied values as `vocab_filename`.","fix":null,"status":"open","published_at":"2026-11-02T03:17:30+00:00","first_seen_at":"2026-11-02T03:31:23+00:00","triaged_at":"2026-11-02T03:31:59+00:00","updated_at":"2026-11-02T03:31:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T03:31:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"deepset FARM: tokenizer loader lets remote requests traverse file paths","impact":"medium","summary":"deepset FARM up to version 0.8.0 has a path traversal flaw in EmbeddingTokenizer.from_pretrained, where a manipulated vocab_filename argument is not restricted. A remote attacker can use it to reach files outside the intended directory, and a public exploit has been published.","audience":"developers","category":"package","nicknames":[],"who_cares":["farm","python","nlp"],"confidence":0.7,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads arbitrary files on the server running FARM","analyst_note":"","how_to_check":"- Check whether the installed FARM version is `0.8.0` or lower.\n- Look for calls to `EmbeddingTokenizer.from_pretrained` that pass user-supplied values as `vocab_filename`.","plain_action":"","needs_analyst":false,"not_affected_if":[],"who_is_affected":"Applications that use FARM's EmbeddingTokenizer.from_pretrained and pass it a value an outside party can influence, such as a request parameter or uploaded configuration. The sources say the vendor did not respond and the affected versions are no longer supported by the maintainer. Teams that load tokenizers only from fixed, trusted paths are not exposed through this flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001106,"input_tokens":4188,"output_tokens":1375,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120334':13A,16A '-2026':12A,15A '0.8.0':26B,76C 'affect':139C 'ai':72C 'argument':40B,97C 'attack':46B,106C 'compon':89C 'contact':124C 'cve':11A,14A 'deepset':1A,21B,71C 'deepset-ai':70C 'directori':56B 'disclosur':128C 'earli':125C 'embeddingtokenizer.from':33B,81C 'execut':92C 'exploit':60B,113C 'farm':2A,17B,22B,73C 'farm/modeling/tokenization.py':86C 'file':9A,52B,85C 'filenam':39B,99C 'flaw':31B,65C 'found':68C 'function':80C 'impact':78C 'intend':55B 'lead':101C 'let':5A 'loader':4A,91C 'longer':144C 'maintain':148C 'manipul':37B,94C 'may':107C,118C 'nlp':18B 'outsid':53B 'packag':19B 'path':10A,29B,103C 'perform':109C 'pretrain':34B,82C 'product':140C 'public':59B 'publish':63B,116C 'python':20B 'reach':51B 'remot':6A,45B,111C 'request':7A 'respond':132C 'restrict':43B 'support':145C 'token':3A,90C 'travers':8A,30B,104C 'use':48B,120C 'vendor':122C 'version':25B 'vocab':38B,98C 'vulner':137C 'way':135C","nicknames":[],"mitigations":[],"who_affected":"Applications that use FARM's EmbeddingTokenizer.from_pretrained and pass it a value an outside party can influence, such as a request parameter or uploaded configuration. The sources say the vendor did not respond and the affected versions are no longer supported by the maintainer. Teams that load tokenizers only from fixed, trusted paths are not exposed through this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["farm","medium","nlp","package","python"],"first_public_at":"2026-11-02T03:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120334","severity":null,"published_at":"2026-11-02T03:17:30+00:00","modified_at":"2026-11-02T03:17:30+00:00","first_seen_at":"2026-11-02T03:31:23+00:00","fetched_at":"2026-11-02T03:31:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}