CVE-2026-120334

The record

A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.from_pretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocab_filename can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Affected packages

Related vulnerabilities

• CVE-2026-108327 Tanium addressed a path traversal vulnerability in Tanium Data Service. CWE-22
• CVE-2026-121542 In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may… CWE-22
• CVE-2026-63502 Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics… CWE-22
• CVE-2026-63478 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-22
• CVE-2026-63500 Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics… CWE-22
• CVE-2026-63395 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-22
• CVE-2026-63436 zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. CWE-22
• CVE-2026-121263 A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. CWE-22