CVE-2026-122188 · Other
NO FIX YET
DeepGraphLearning KnowledgeGraphEmbedding's override_config function in codes/run.py does not restrict the data_path argument, so a crafted path can escape the intended directory. An attacker who can supply that argument can read files the process can reach on the host.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that wrap codes/run.py of KnowledgeGraphEmbedding in a service, pipeline or shared notebook where someone else can supply --data_path or a checkpoint directory with a crafted config.json. The script is a research command-line tool, so running it yourself with your own arguments is not exposed. No fixed version exists: the project uses rolling commits and has not answered the issue report.
Not affected if cli-only-trusted-user, no-untrusted-input, offline-only-use
Who cares knowledgegraphembedding, python, research-code, self-hosted
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A flaw has been found in DeepGraphLearning KnowledgeGraphEmbedding up to 2e440e0f9c687314d5ff67ead68ce985dc446e3a. Impacted is the function override_config of the file codes/run.py of the component Checkpoint Loading. This manipulation of the argument data_path causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.