CVE-2026-126996

MediumCVSS 6.3/10Last modified Nov 12, 2026

Description

A vulnerability was determined in SakanaAI text-to-LoRA 0.0.1. Affected by this issue is the function get_tokenizer of the file src/hyper_llm_modulator/utils/model_loading.py of the component Checkpoint Loading. Executing a manipulation of the argument base_model_name_or_path can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
SakanaAI	text-to-LoRA	0.0.1

References

Timeline

Published: Nov 12, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1269977.3A vulnerability was identified in JeecgBoot up to 3.9.6. This affects the function RestTemplate.exchange of the file org/jeecg/modules/airag CVE-2026-1269987.3A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiController.call of the file /op CVE-2026-127019.0A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin wit CVE-2026-1270169.2The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configuration) that di CVE-2026-127024.9In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deploymen CVE-2026-127038.0TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to by CVE-2026-1270368.6Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS. This issue affects WebFOCUS: 9.1, from 9.2 thro CVE-2026-127046.8When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML resp CVE-2026-1270469.2The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /externa CVE-2026-127056.4Missing support for integrity check vulnerability in ABB KNX Update Tool (ABB), ABB KNX Update Tool (BJE). This issue affects KNX Update To CVE-2026-1270506.4Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker t CVE-2026-1270567.5PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause de