CVE-2026-112140: Code Injection in llSourcell Doctor-Dignity

This vulnerability in llSourcell Doctor-Dignity up to commit 3f2ffb6c892f13b50a708d05900d3227acb40ded allows remote code injection via the model_lib argument in the _get_lib_module function within python/mlc_chat/chat_module.py. The rolling release nature of the product means no discrete version numbers are available to identify affected or patched versions. The vulnerability was responsibly disclosed but remains unpatched at the time of this report. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low to limited impacts on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to inject and execute arbitrary code within the affected function, potentially compromising the system running Doctor-Dignity. The medium CVSS score reflects moderate risk due to required user interaction and limited impact scope. No known exploits are currently observed in the wild.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the project's communications for updates and consider restricting access to the vulnerable function or environment as a temporary measure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.