Threats affecting pkg:github/sakanaai/text-to-lora

CVE-2026-126996 is a path traversal vulnerability in SakanaAI text-to-LoRA version 0.0.1. The flaw exists in the get_tokenizer function within the src/hyper_llm_modulator/utils/model_loading.py file, specifically in the Checkpoint Loading component. Manipulating the base_model_name_or_path argument can allow an attacker to perform path traversal. The vulnerability can be exploited remotely and public exploit code has been disclosed. The vendor has been informed but has not yet responded or issued a fix.