CVE-2026-122015
Full vulnerability record from the local CVENow database.
Description
A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get_mlx_response of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely. The exploit has been made public and could be used.
Severity
LOW
CVSS score
2.1
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-11-04 22:17:55.427000
Last modified
2026-11-04 22:17:55.627000
View original CVE JSON
{
"id": "CVE-2026-122015",
"sourceIdentifier": "[email protected]",
"published": "2026-11-04T22:17:55.427",
"lastModified": "2026-11-04T22:17:55.627",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get_mlx_response of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely. The exploit has been made public and could be used."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "NPC-Worldwide",
"product": "npcpy",
"cpes": [
"cpe:2.3:a:npc-worldwide:npcpy:*:*:*:*:*:*:*:*"
],
"modules": [
"MLX Provider"
],
"versions": [
{
"version": "2.1.0",
"status": "affected"
},
{
"version": "2.1.1",
"status": "affected"
},
{
"version": "2.1.2",
"status": "affected"
},
{
"version": "2.1.3",
"status": "affected"
},
{
"version": "2.1.4",
"status": "affected"
},
{
"version": "2.1.5",
"status": "affected"
},
{
"version": "2.1.6",
"status": "affected"
},
{
"version": "2.1.7",
"status": "affected"
},
{
"version": "2.1.8",
"status": "affected"
},
{
"version": "2.1.9",
"status": "affected"
},
{
"version": "2.1.10",
"status": "affected"
},
{
"version": "2.1.11",
"status": "affected"
},
{
"version": "2.1.12",
"status": "affected"
},
{
"version": "2.1.13",
"status": "affected"
},
{
"version": "2.1.14",
"status": "affected"
},
{
"version": "2.1.15",
"status": "affected"
},
{
"version": "2.1.16",
"status": "affected"
},
{
"version": "2.1.17",
"status": "affected"
},
{
"version": "2.1.18",
"status": "affected"
},
{
"version": "2.1.19",
"status": "affected"
},
{
"version": "2.1.20",
"status": "affected"
},
{
"version": "2.1.21",
"status": "affected"
},
{
"version": "2.1.22",
"status": "affected"
},
{
"version": "2.1.23",
"status": "affected"
},
{
"version": "2.1.24",
"status": "affected"
},
{
"version": "2.1.25",
"status": "affected"
},
{
"version": "2.1.26",
"status": "affected"
},
{
"version": "2.1.27",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.1,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"baseScore": 7.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"references": [
{
"url": "https://github.com/NPC-Worldwide/npcpy/",
"source": "[email protected]"
},
{
"url": "https://github.com/NPC-Worldwide/npcpy/issues/309",
"source": "[email protected]"
},
{
"url": "https://github.com/user-attachments/files/33302583/poc.zip",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-122015",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/1024531",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/431083",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/431083/cti",
"source": "[email protected]"
}
]
}