Threats affecting pkg:github/tjake/Jlama

CVE-2026-126995 is a path traversal vulnerability in the SafeTensorIndex.loadWeights function of the tjake Jlama project affecting versions 0.8.0 through 0.9.0-beta. The flaw allows remote attackers to manipulate the weight_map argument to perform path traversal. Exploit code has been publicly disclosed, but no vendor response or patch is currently available.