A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0.
CVE-2026-116103
A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function loadparamintxt of the file python/src/nnabla/utils/cli/encodedecodeparam.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Assessment
- CVSS
- 2.1 (v4.0)
- Severity
- Low
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 26 October 2026
- Last updated
- 29 October 2026
- Weakness
- CWE-74, CWE-94
- Assigner
- cna@vuldb.com
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
At the source
References
- https://github.com/3em0/cve_repo/blob/main/2026/Neural-Network-Libraries-(nnabla)%E2%89%A4v1.39.0-Python-eval()-Code-Injection-in-'nnabla_cli%20encode_param'-Leading-to-Arbitrary-Command-Execution.md
- https://vuldb.com/cve/CVE-2026-116103
- https://vuldb.com/submit/1003039
- https://vuldb.com/vuln/426171
- https://vuldb.com/vuln/426171/cti
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-116103