---
id: "CVE-2026-126996"
page: "https://infrastack.ai/live/CVE-2026-126996"
kind: "vulnerability"
aliases: ["CVE-2026-126996"]
title: "SakanaAI text-to-LoRA: unvalidated base_model_name_or_path lets a checkpoint read files outside chat_templates/"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "text-to-lora", "fixed": [], "affected": "= 0.0.1", "ecosystem": "pip"}]
ecosystems: []
tags: ["ai-tooling", "path-traversal", "python", "text-to-lora"]
not_affected_if: ["no-remote-exposure", "trusted-input-only"]
published_at: "2026-11-12T15:17:48+00:00"
first_seen_at: "2026-11-12T15:41:57+00:00"
updated_at: "2026-11-12T15:45:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126996", "first_seen_at": "2026-11-12T15:41:57+00:00"}, {"source": "analyst", "url": "https://github.com/SakanaAI/text-to-lora/issues/13", "first_seen_at": "2026-11-12T15:45:06+00:00", "cites": ["https://github.com/SakanaAI/text-to-lora/issues/13", "https://github.com/SakanaAI/text-to-lora/blob/main/src/hyper_llm_modulator/utils/model_loading.py"]}]
exploit_sources: []
---

# SakanaAI text-to-LoRA: unvalidated base_model_name_or_path lets a checkpoint read files outside chat_templates/

Link for people: https://infrastack.ai/live/CVE-2026-126996 (this .md is for agents)

In text-to-LoRA 0.0.1, get_tokenizer() builds the chat-template path from base_model_name_or_path in a checkpoint's adapter_config.json without validation. The reporter (GitHub issue #13) says ../ sequences make it read chat_template.jinja files from other directories and replace the run's chat template. The reporter says no code execution occurs, since trust_remote_code is not set. The reporter's PoC is public as an attachment. No maintainer reply or fix is visible.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pip:text-to-lora affected = 0.0.1 fixed no fixed version listed

## How to check

- Check whether you run SakanaAI/text-to-lora at 0.0.1 (commit 8ba7749) or current main (the reporter says main had the same code on 2026-10-16).
- Check whether scripts/generate_lora.py or webui/app.py load checkpoints or adapter_config.json files you did not produce yourself.
- Inspect any adapter_config.json you load: base_model_name_or_path must not contain '..', '/' beyond a normal model id, or '\'.
- Workaround: only load checkpoints you trust, or patch get_tokenizer to reject values with '/', '\' or '..', or to require the resolved path to stay inside chat_templates/ (reporter's suggestion).

## Timeline

- 2026-11-12T15:41:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126996
- 2026-11-12T15:45:06+00:00 analyst https://github.com/SakanaAI/text-to-lora/issues/13 — Primary source is the reporter's GitHub issue #13 (open, no maintainer reply or fix visible). The reporter rates it 4.6 medium and describes a local file read and template override, not remote code execution; NVD/VulDB says 7.5 high. I left severity unchanged and verified nothing, because the sources are an issue and not a vendor advisory. X search skipped (not needed).

## Documents

- [advisory] Path traversal via adapter_config.json base_model_name_or_path (issue #13) https://github.com/SakanaAI/text-to-lora/issues/13
- [describes] text-to-lora model_loading.py https://github.com/SakanaAI/text-to-lora/blob/main/src/hyper_llm_modulator/utils/model_loading.py

## From the sources

A vulnerability was determined in SakanaAI text-to-LoRA 0.0.1. Affected by this issue is the function get_tokenizer of the file src/hyper_llm_modulator/utils/model_loading.py of the component Checkpoint Loading. Executing a manipulation of the argument base_model_name_or_path can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_