NPCPY · CVE-2026-122014 · AI agents & MCP
NO FIX YET
load_sft_model() in npcpy/ft/sft.py reads base_model_name_or_path from the adapter's adapter_config.json and passes it to from_pretrained with trust_remote_code=True hardcoded. If the named base-model repo ships a modeling_*.py file, it runs in the loading process before the adapter weights load. The reporter's PoC shows this. As of 2026-11-04 the issue is open and the latest release (2.1.27) is still listed as affected.
first public Nov 4, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that call npcpy's load_sft_model on an adapter they did not train themselves (a Hugging Face Hub adapter, a colleague's or an agent's output, or a user-supplied path) are exposed. Loading such an adapter runs Python from the base-model repo it names, with the loader's privileges and access to its environment variables and cloud credentials. You can skip this if you only load adapters you trained yourself on a base model you chose, or if you do not use npcpy's fine-tuning module.
Not affected if hard-coded-model-path, no-sft-usage, trusted-adapters-only
Who cares fine-tuning, llm, npcpy, pypi, python, trust-remote-code
pip show npcpy: 2.1.27 and earlier are affected, and 2.1.27 is the latest release, so no fixed version exists yet.load_sft_model (also used by npcpy/ft/model_ensembler.py). Check whether the adapter directory or Hub repo id you pass in can come from someone you do not trust.No fix yet, per the sources.
A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.