CVE-2026-122015: npcpy: improper input validation in MLX provider

MEDIUM

Published November 4, 2026

CISO Take

CVE-2026-122015 is an improper input validation flaw in the MLX provider function get_mlx_response of npcpy (up to 2.1.27), where a manipulated model argument can be abused remotely. Severity is medium (CVSS 6.3) and the issue is not in CISA KEV, but a proof-of-concept archive is linked from the upstream GitHub issue and the VulDB entry states the exploit is public, so weaponization is cheap. No EPSS score, dependent count or patched version is available, so blast radius is unknown and likely limited to teams using npcpy's MLX backend (mostly Apple Silicon dev and prototype environments). Inventory where npcpy is deployed, check whether the model parameter can be influenced by end users or untrusted agent input, and restrict it to an allowlist of vetted model identifiers until the maintainers ship a fix; track upstream issue #309 for a patched release.

Sources:NVDATLASVulDBGitHub (NPC-Worldwide/npcpy issue #309)

What is the risk?

Medium overall. Exploitability is high on paper (network vector, low complexity, no privileges) but requires user interaction and impacts are only low for confidentiality, integrity and availability. A public PoC raises likelihood, yet there is no KEV listing, no Nuclei template and no EPSS data, and the MLX provider is a niche code path. Risk rises sharply if model names are derived from untrusted input in a web-exposed service or agent. The exact exploit primitive is not detailed in the advisory, so impact beyond input validation bypass is unconfirmed (confidence: MEDIUM).

How does the attack unfold?

Initial Access

Attacker reaches a network-exposed npcpy-based application that accepts a model parameter.

AML.T0049

Exploitation

A crafted model value bypasses input validation in get_mlx_response using the public PoC.

AML.T0016.000

Impact

Unintended model handling causes limited data exposure, tampering or service disruption.

Initial Access

Attacker reaches a network-exposed npcpy-based application that accepts a model parameter.

AML.T0049

Exploitation

A crafted model value bypasses input validation in get_mlx_response using the public PoC.

AML.T0016.000

Impact

Unintended model handling causes limited data exposure, tampering or service disruption.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLX	pip	—	No patch
29.0K429 dependentsPushed 4d ago40% patched~11d to patchFull package profile →
npcpy	—	—	No patch

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CLow

ILow

ALow

What should I do?

1 step

1) Identify npcpy installations at version 2.1.27 or earlier (pip list, SBOM, dependency scans). 2) Upgrade as soon as a fixed release is published; monitor https://github.com/NPC-Worldwide/npcpy/issues/309. 3) Until then, enforce a strict allowlist for the model argument before it reaches get_mlx_response and never pass raw user input as the model name. 4) Disable or avoid the MLX provider on services exposed to untrusted users. 5) Log and alert on unexpected model identifiers, unusual file path patterns, or failed model loads. 6) Review the public PoC in an isolated environment only to build detection rules.

How is it classified?

Supply ChainDoSFrameworkInferenceAML.T0016.000- Adversarial AI Attack Implementations AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and AI system vulnerabilities

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-122015?

Is CVE-2026-122015 actively exploited?

No confirmed active exploitation of CVE-2026-122015 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-122015?

1) Identify npcpy installations at version 2.1.27 or earlier (pip list, SBOM, dependency scans). 2) Upgrade as soon as a fixed release is published; monitor https://github.com/NPC-Worldwide/npcpy/issues/309. 3) Until then, enforce a strict allowlist for the model argument before it reaches get_mlx_response and never pass raw user input as the model name. 4) Disable or avoid the MLX provider on services exposed to untrusted users. 5) Log and alert on unexpected model identifiers, unusual file path patterns, or failed model loads. 6) Review the public PoC in an isolated environment only to build detection rules.

What systems are affected by CVE-2026-122015?

This vulnerability affects the following AI/ML architecture patterns: Local model inference (MLX / Apple Silicon), Agent frameworks, LLM orchestration libraries.

What is the CVSS score for CVE-2026-122015?

CVE-2026-122015 has a CVSS v3.1 base score of 6.3 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

Local model inference (MLX / Apple Silicon)Agent frameworksLLM orchestration libraries

MITRE ATLAS Techniques

AML.T0016.000Adversarial AI Attack Implementations

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get_mlx_response of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validation. The attack can be launched remotely. The exploit has been made public and could be used.

Exploitation Scenario

An attacker finds an application or chat interface built on npcpy that lets users select or influence the model name for MLX-backed inference. They send a crafted model value, following the public PoC, that is not properly validated. This prompts the MLX provider to load or process an unintended resource or to behave in unexpected ways, degrading availability or leaking or altering limited data. User interaction, such as a victim opening a crafted link or loading a shared configuration that sets the model, may be needed to trigger the request.

Weaknesses (CWE)

CWE-20Improper Input ValidationPrimary CWE-20Improper Input Validation

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.