{"id":"CVE-2026-122015","kind":"vulnerability","aliases":["CVE-2026-122015"],"related":[],"title":"npcpy MLX provider: improper input validation in model argument","description":"A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get_mlx_response of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely. The exploit has been made public and could be used.","summary":"npcpy, an NPC-Worldwide Python library for LLM agents, has an input validation flaw in its MLX provider's get_mlx_response function, triggered through the model argument. The exploit is public, and the sources say an attacker can trigger it remotely, but they do not state what an attacker gets beyond that.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","llm-agents","mlx","npcpy","python"],"not_affected_if":["default-config","hardcoded-model-name"],"how_to_check":"- Check the installed npcpy version with `pip show npcpy`; versions up to 2.1.27 are affected.\n- Look for calls to `get_mlx_response` or the MLX provider in `npcpy/gen/response.py` that pass user-controlled values as `model`.","fix":"- npcpy: unknown; the sources do not name a fixed version.","status":"open","published_at":"2026-11-04T22:17:55+00:00","first_seen_at":"2026-11-04T23:08:48+00:00","triaged_at":"2026-11-04T23:09:53+00:00","updated_at":"2026-11-04T23:09:53+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-11-04T23:09:53Z","model":"claude-haiku-5-5","output":{"fix":"- npcpy: unknown; the sources do not name a fixed version.","reach":"network","title":"npcpy MLX provider: improper input validation in model argument","impact":"medium","summary":"npcpy, an NPC-Worldwide Python library for LLM agents, has an input validation flaw in its MLX provider's get_mlx_response function, triggered through the model argument. The exploit is public, and the sources say an attacker can trigger it remotely, but they do not state what an attacker gets beyond that.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["npcpy","python","mlx","llm-agents"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; the sources do not state the impact beyond improper input validation","analyst_note":"Find out what the model argument flaw allows (code execution, file access, or only errors) and whether a fixed npcpy release exists; check the NVD entry and the upstream npcpy repository.","how_to_check":"- Check the installed npcpy version with `pip show npcpy`; versions up to 2.1.27 are affected.\n- Look for calls to `get_mlx_response` or the MLX provider in `npcpy/gen/response.py` that pass user-controlled values as `model`.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","hardcoded-model-name"],"who_is_affected":"Teams that use the npcpy library with the MLX provider and pass model names that come from user input or outside the application are exposed. Projects that use npcpy with other providers, or that hard-code the model name, are less likely to be reached. The sources do not say what exactly happens after the validation failure.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000734,"input_tokens":4231,"output_tokens":622,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-122015':12A,15A '-2026':11A,14A '2.1.27':89C 'affect':92C 'agent':21B,34B 'ai':17B 'ai-tool':16B 'argument':9A,53B,111C 'attack':63B,75B,119C 'beyond':77B 'compon':104C 'could':131C 'cve':10A,13A 'exploit':55B,125C 'file':100C 'flaw':39B 'found':81C 'function':48B,94C 'get':45B,76B,95C 'improp':4A,115C 'input':5A,37B,116C 'launch':122C 'librari':31B 'llm':20B,33B 'llm-agent':19B 'made':128C 'manipul':108C 'mlx':2A,22B,42B,46B,96C,105C 'model':8A,52B,112C 'npc':28B,84C 'npc-worldwid':27B,83C 'npcpi':1A,23B,25B,86C 'npcpy/gen/response.py':101C 'provid':3A,43B,106C 'public':57B,129C 'python':24B,30B 'remot':67B,123C 'respons':47B,97C 'result':113C 'say':61B 'sourc':60B 'state':72B 'tool':18B 'trigger':49B,65B 'use':133C 'valid':6A,38B,117C 'vulner':79C,91C 'worldwid':29B,85C","nicknames":[],"mitigations":[],"who_affected":"Teams that use the npcpy library with the MLX provider and pass model names that come from user input or outside the application are exposed. Projects that use npcpy with other providers, or that hard-code the model name, are less likely to be reached. The sources do not say what exactly happens after the validation failure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","high","llmagents","mlx","npcpy","python"],"campaign_type":null,"first_public_at":"2026-11-04T22:17:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122015","severity":null,"published_at":"2026-11-04T22:17:55+00:00","modified_at":"2026-11-04T22:17:55+00:00","first_seen_at":"2026-11-04T23:08:48+00:00","fetched_at":"2026-11-04T23:08:48+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}