Threats tagged 'ghsa-jv6g-mcg6-wpx7'

A code injection vulnerability exists in NPC-Worldwide npcpy versions up to 2.1.27 in the load_sft_model function due to unsafe handling of the base_model_name_or_path argument. This vulnerability can be exploited remotely and has publicly disclosed exploit code. The CVSS score is 6.3, indicating medium severity.