Threats affecting pkg:pypi/farm

CVE-2026-120335 is a path traversal vulnerability in the deepset-ai farm product up to version 0.8.0. The flaw exists in the WordEmbedding_LM.load function within the farm/modeling/language_model.py file, where manipulation of the embeddings_filename argument allows local attackers to perform path traversal. The vulnerability affects only unsupported versions of the product. Public exploit details have been disclosed, but no vendor response or patch is available. The severity is rated low with a CVSS 4.0 score of 2.4.

CVE-2026-120334 is a path traversal vulnerability in deepset-ai farm versions up to 0.8.0. It affects the EmbeddingTokenizer.from_pretrained function in the farm/modeling/tokenization.py file. Manipulating the vocab_filename argument can allow an attacker to perform path traversal remotely. The vulnerability affects unsupported versions of the product. Exploit code has been published, but no active exploitation in the wild is confirmed.