{"id":"CVE-2026-126996","kind":"vulnerability","aliases":["CVE-2026-126996"],"related":[],"title":"SakanaAI text-to-LoRA: unvalidated base_model_name_or_path lets a checkpoint read files outside chat_templates/","description":"A vulnerability was determined in SakanaAI text-to-LoRA 0.0.1. Affected by this issue is the function get_tokenizer of the file src/hyper_llm_modulator/utils/model_loading.py of the component Checkpoint Loading. Executing a manipulation of the argument base_model_name_or_path can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.","summary":"In text-to-LoRA 0.0.1, get_tokenizer() builds the chat-template path from base_model_name_or_path in a checkpoint's adapter_config.json without validation. The reporter (GitHub issue #13) says ../ sequences make it read chat_template.jinja files from other directories and replace the run's chat template. The reporter says no code execution occurs, since trust_remote_code is not set. The reporter's PoC is public as an attachment. No maintainer reply or fix is visible.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"text-to-lora","fixed":[],"affected":"= 0.0.1","ecosystem":"pip"}],"ecosystems":[],"tags":["ai-tooling","path-traversal","python","text-to-lora"],"not_affected_if":["no-remote-exposure","trusted-input-only"],"how_to_check":"- Check whether you run SakanaAI/text-to-lora at 0.0.1 (commit 8ba7749) or current main (the reporter says main had the same code on 2026-10-16).\n- Check whether scripts/generate_lora.py or webui/app.py load checkpoints or adapter_config.json files you did not produce yourself.\n- Inspect any adapter_config.json you load: base_model_name_or_path must not contain '..', '/' beyond a normal model id, or '\\'.\n- Workaround: only load checkpoints you trust, or patch get_tokenizer to reject values with '/', '\\' or '..', or to require the resolved path to stay inside chat_templates/ (reporter's suggestion).","fix":null,"status":"open","published_at":"2026-11-12T15:17:48+00:00","first_seen_at":"2026-11-12T15:41:57+00:00","triaged_at":"2026-11-12T15:43:48+00:00","updated_at":"2026-11-12T15:45:06+00:00","category":"ai-tooling","confidence":0.75,"triage":{"at":"2026-11-12T15:43:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SakanaAI text-to-LoRA: path traversal through model loading argument","impact":"medium","summary":"The get_tokenizer function in text-to-LoRA 0.0.1 does not sanitize the base_model_name_or_path argument when loading checkpoints. A remote attacker can manipulate that argument to traverse paths on the server and reach files outside the intended directory.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["text-to-lora","python","ai-tooling"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads arbitrary files on the server through path traversal","analyst_note":"Confirm whether a fixed version or a mitigation exists and whether the project has responded; the sources only show an open issue report and a public exploit.","how_to_check":"- Check whether you run text-to-LoRA (`pip show text-to-lora` or the project's `pyproject.toml`) at version `0.0.1`.\n- Look for calls to `get_tokenizer` in `src/hyper_llm_modulator/utils/model_loading.py` that take input from requests or other untrusted sources.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only","no-remote-exposure"],"who_is_affected":"Teams that expose text-to-LoRA's checkpoint loading to untrusted input, such as a web endpoint or API that accepts a base model name, are exposed. Local use with trusted inputs only is lower risk. The sources do not say whether a fixed version exists, and the project has not responded to the report.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000773,"input_tokens":4615,"output_tokens":623,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a fixed version or a mitigation exists and whether the project has responded; the sources only show an open issue report and a public exploit.","search":"'-126996':22A,25A '-2026':21A,24A '0.0.1':46B,130C '13':72B 'adapter_config.json':65B 'affect':131C 'ai':31B 'ai-tool':30B 'argument':154C 'attach':112B 'attack':166C 'base':7A,56B,155C 'build':49B 'chat':18A,52B,88B 'chat-templ':51B 'chat_template.jinja':78B 'checkpoint':14A,63B,147C 'code':94B,100B 'compon':146C 'cve':20A,23A 'determin':123C 'directori':82B 'disclos':176C 'earli':188C 'execut':95B,149C 'exploit':172C 'file':16A,79B,142C 'fix':117B 'function':137C 'get':47B,138C 'github':70B 'inform':184C 'issu':71B,134C,191C 'launch':169C 'lead':161C 'let':12A 'load':148C 'lora':5A,29A,40B,45B,129C 'maintain':114B 'make':75B 'manipul':151C 'may':167C,178C 'model':8A,57B,156C 'name':9A,58B,157C 'occur':96B 'outsid':17A 'path':11A,34B,54B,60B,159C,163C 'path-travers':33B 'poc':107B 'problem':187C 'project':182C 'public':109B,175C 'python':36B 'read':15A,77B 'remot':99B,170C 'replac':84B 'repli':115B 'report':69B,91B,105B,192C 'respond':196C 'run':86B 'sakanaai':1A,125C 'say':73B,92B 'sequenc':74B 'set':103B 'sinc':97B 'src/hyper_llm_modulator/utils/model_loading.py':143C 'templat':19A,53B,89B 'text':3A,27A,38B,43B,127C 'text-to-lora':2A,26A,37B,42B,126C 'to':28A 'token':48B,139C 'tool':32B 'travers':35B,164C 'trust':98B 'unvalid':6A 'util':180C 'valid':67B 'visibl':119B 'vulner':121C 'without':66B 'yet':197C","nicknames":[],"mitigations":[],"who_affected":"Teams running text-to-LoRA 0.0.1 or current main, especially behind the web UI (webui/app.py) or any service that loads checkpoints or adapter configs from outside sources, are exposed. The attacker needs the victim to load a crafted checkpoint config, and the reporter describes the result as an out-of-tree file read and chat-template takeover, not code execution. Anyone who only loads their own trusted checkpoints can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["texttolora"],"ptokens":["lora","text","to"],"labels":["aitooling","high","pathtraversal","python","texttolora"],"campaign_type":null,"search_a":"'-126996':22A,25A '-2026':21A,24A 'base':7A 'chat':18A 'checkpoint':14A 'cve':20A,23A 'file':16A 'let':12A 'lora':5A,29A 'model':8A 'name':9A 'outsid':17A 'path':11A 'read':15A 'sakanaai':1A 'templat':19A 'text':3A,27A 'text-to-lora':2A,26A 'to':28A 'unvalid':6A","search_b":"'0.0.1':46B '13':72B 'adapter_config.json':65B 'ai':31B 'ai-tool':30B 'attach':112B 'base':56B 'build':49B 'chat':52B,88B 'chat-templ':51B 'chat_template.jinja':78B 'checkpoint':63B 'code':94B,100B 'directori':82B 'execut':95B 'file':79B 'fix':117B 'get':47B 'github':70B 'issu':71B 'lora':40B,45B 'maintain':114B 'make':75B 'model':57B 'name':58B 'occur':96B 'path':34B,54B,60B 'path-travers':33B 'poc':107B 'public':109B 'python':36B 'read':77B 'remot':99B 'replac':84B 'repli':115B 'report':69B,91B,105B 'run':86B 'say':73B,92B 'sequenc':74B 'set':103B 'sinc':97B 'templat':53B,89B 'text':38B,43B 'text-to-lora':37B,42B 'token':48B 'tool':32B 'travers':35B 'trust':98B 'valid':67B 'visibl':119B 'without':66B","search_c":"'0.0.1':130C 'affect':131C 'argument':154C 'attack':166C 'base':155C 'checkpoint':147C 'compon':146C 'determin':123C 'disclos':176C 'earli':188C 'execut':149C 'exploit':172C 'file':142C 'function':137C 'get':138C 'inform':184C 'issu':134C,191C 'launch':169C 'lead':161C 'load':148C 'lora':129C 'manipul':151C 'may':167C,178C 'model':156C 'name':157C 'path':159C,163C 'problem':187C 'project':182C 'public':175C 'remot':170C 'report':192C 'respond':196C 'sakanaai':125C 'src/hyper_llm_modulator/utils/model_loading.py':143C 'text':127C 'text-to-lora':126C 'token':139C 'travers':164C 'util':180C 'vulner':121C 'yet':197C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126996","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126996","severity":null,"published_at":"2026-11-12T15:17:48+00:00","modified_at":"2026-11-12T15:17:49+00:00","first_seen_at":"2026-11-12T15:41:57+00:00","fetched_at":"2026-11-12T15:41:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126996:3748","url":"https://github.com/SakanaAI/text-to-lora/issues/13","severity":null,"published_at":"2026-11-12T15:45:06+00:00","modified_at":"2026-11-12T15:45:06+00:00","first_seen_at":"2026-11-12T15:45:06+00:00","fetched_at":"2026-11-12T15:45:06+00:00","note":"Primary source is the reporter's GitHub issue #13 (open, no maintainer reply or fix visible). The reporter rates it 4.6 medium and describes a local file read and template override, not remote code execution; NVD/VulDB says 7.5 high. I left severity unchanged and verified nothing, because the sources are an issue and not a vendor advisory. X search skipped (not needed).","cites":["https://github.com/SakanaAI/text-to-lora/issues/13","https://github.com/SakanaAI/text-to-lora/blob/main/src/hyper_llm_modulator/utils/model_loading.py"]}],"documents":[{"id":136118,"url":"https://github.com/SakanaAI/text-to-lora/issues/13","title":"Path traversal via adapter_config.json base_model_name_or_path (issue #13)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":136119,"url":"https://github.com/SakanaAI/text-to-lora/blob/main/src/hyper_llm_modulator/utils/model_loading.py","title":"text-to-lora model_loading.py","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}