CVE-2026-122015— NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation

Quick assessment

Affected

NPC-Worldwide npcpy

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 NPC-Worldwide 的 npcpy 组件（版本 2.1.27 及以下）中发现了一个漏洞。该漏洞影响 MLX Provider 组件中文件 npcpy/gen/response.py 的 get_mlx_response 函数。由于对 model 参数缺乏适当的输入验证，攻击者可通过操纵该参数发起远程攻击。目前，相关利用代码（Exploit）已公开，可能被用于实际攻击。

CVSS 6.3 · Medium Updated Nov 05, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get_mlx_response of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely. The exploit has been made public and could be used.

Source: CVE Program / CVE List V5