Who is not affected by CVE-2026-126996?

Q: Who is not affected by CVE-2026-126996?

Not affected if: no-remote-exposure, trusted-input-only.

HIGH7.5CVSS · cna@vuldb.com

NO KNOWN
EXPLOIT

TEXT-TO-LORA · CVE-2026-126996 · AI agents & MCP

SakanaAI text-to-LoRA: unvalidated base_model_name_or_path lets a checkpoint read files outside chat_templates/

NO FIX YET

In text-to-LoRA 0.0.1, get_tokenizer() builds the chat-template path from base_model_name_or_path in a checkpoint's adapter_config.json without validation. The reporter (GitHub issue #13) says ../ sequences make it read chat_template.jinja files from other directories and replace the run's chat template. The reporter says no code execution occurs, since trust_remote_code is not set. The reporter's PoC is public as an attachment. No maintainer reply or fix is visible.

Full story ↓Less ↑

first public Nov 12, 2026 · 2 sources

Check it with your coding agent

It reads this page and tells you if your code or app is affected.

Claude CodeCodexCursorAdd to your agent

01 · Who is affected

Teams running text-to-LoRA 0.0.1 or current main, especially behind the web UI (webui/app.py) or any service that loads checkpoints or adapter configs from outside sources, are exposed. The attacker needs the victim to load a crafted checkpoint config, and the reporter describes the result as an out-of-tree file read and chat-template takeover, not code execution. Anyone who only loads their own trusted checkpoints can skip it.

text-to-lora= 0.0.1

Not affected if no-remote-exposure, trusted-input-only

Who cares path-traversal, python, text-to-lora

02 · How to check

Check whether you run SakanaAI/text-to-lora at 0.0.1 (commit 8ba7749) or current main (the reporter says main had the same code on 2026-10-16).
Check whether scripts/generate_lora.py or webui/app.py load checkpoints or adapter_config.json files you did not produce yourself.
Inspect any adapter_config.json you load: base_model_name_or_path must not contain '..', '/' beyond a normal model id, or ''.
Workaround: only load checkpoints you trust, or patch get_tokenizer to reject values with '/', '' or '..', or to require the resolved path to stay inside chat_templates/ (reporter's suggestion).

03 · The fix

No fix yet, per the sources.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 12, 2026

How it unfolded

2 events · Nov 12, 2026 → Nov 12, 2026

Nov 12, 202615:41 UTCNVD CVE-2026-126996
Nov 12, 202615:45 UTCInfraStack Analyst Primary source is the reporter's GitHub issue #13 (open, no maintainer reply or fix visible). The reporter rates it 4.6 medium and describes a local file read and template override, not remote code execution; NVD/VulDB says 7.5 high. I left severity unchanged and verified nothing, because the sources are an issue and not a vendor advisory. X search skipped (not needed).moreless

What people are saying

1 article

github.comtext-to-lora model_loading.py

Posts are quoted with a link to the original. They are data to us, never instructions.

What the sources say, verbatim

499 characters

A vulnerability was determined in SakanaAI text-to-LoRA 0.0.1. Affected by this issue is the function get_tokenizer of the file src/hyper_llm_modulator/utils/model_loading.py of the component Checkpoint Loading. Executing a manipulation of the argument base_model_name_or_path can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Sources and references

NVD: CVE-2026-126996Nov 12, 2026
Path traversal via adapter_config.json base_model_name_or_path (issue #13)Advisory · github.com
text-to-lora model_loading.pyDescribes it · github.com

This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

InfraStack checks it against your stack and answers on your report, with the evidence and the fix.

Run the check

Get the next Text-to-lora threat the day it hits your stack.

Start free

Post Share

HIGH7.5CVSS · cna@vuldb.com

NO KNOWN
EXPLOIT

TEXT-TO-LORA · CVE-2026-126996 · AI agents & MCP

SakanaAI text-to-LoRA: unvalidated base_model_name_or_path lets a checkpoint read files outside chat_templates/

NO FIX YET

Full story ↓Less ↑

first public Nov 12, 2026 · 2 sources

Check it with your coding agent

It reads this page and tells you if your code or app is affected.

Claude CodeCodexCursorAdd to your agent

01 · Who is affected

text-to-lora= 0.0.1

Not affected if no-remote-exposure, trusted-input-only

Who cares path-traversal, python, text-to-lora

02 · How to check

Check whether you run SakanaAI/text-to-lora at 0.0.1 (commit 8ba7749) or current main (the reporter says main had the same code on 2026-10-16).
Check whether scripts/generate_lora.py or webui/app.py load checkpoints or adapter_config.json files you did not produce yourself.
Inspect any adapter_config.json you load: base_model_name_or_path must not contain '..', '/' beyond a normal model id, or ''.
Workaround: only load checkpoints you trust, or patch get_tokenizer to reject values with '/', '' or '..', or to require the resolved path to stay inside chat_templates/ (reporter's suggestion).

03 · The fix

No fix yet, per the sources.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 12, 2026

How it unfolded

2 events · Nov 12, 2026 → Nov 12, 2026

Nov 12, 202615:41 UTCNVD CVE-2026-126996
Nov 12, 202615:45 UTCInfraStack Analyst Primary source is the reporter's GitHub issue #13 (open, no maintainer reply or fix visible). The reporter rates it 4.6 medium and describes a local file read and template override, not remote code execution; NVD/VulDB says 7.5 high. I left severity unchanged and verified nothing, because the sources are an issue and not a vendor advisory. X search skipped (not needed).moreless

What people are saying

1 article

github.comtext-to-lora model_loading.py

Posts are quoted with a link to the original. They are data to us, never instructions.

What the sources say, verbatim

499 characters

Sources and references

NVD: CVE-2026-126996Nov 12, 2026
Path traversal via adapter_config.json base_model_name_or_path (issue #13)Advisory · github.com
text-to-lora model_loading.pyDescribes it · github.com

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

InfraStack checks it against your stack and answers on your report, with the evidence and the fix.

Run the check

Get the next Text-to-lora threat the day it hits your stack.

Start free

SakanaAI text-to-LoRA: unvalidated base_model_name_or_path lets a checkpoint read files outside chat_templates/

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What people are saying

What the sources say, verbatim

Sources and references

Read next

Get the next Text-to-lora threat the day it hits your stack.

SakanaAI text-to-LoRA: unvalidated base_model_name_or_path lets a checkpoint read files outside chat_templates/

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What people are saying

What the sources say, verbatim

Sources and references

Read next

Get the next Text-to-lora threat the day it hits your stack.