CVE-2026-116103 Details
Description
A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file python/src/nnabla/utils/cli/encode_decode_param.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
A code injection vulnerability has been identified in Sony Neural Network Libraries (nnabla) versions through 1.39.0. The issue resides in the Encode Param Command Handler, specifically within the function load_param_in_txt in the file python/src/nnabla/utils/cli/encode_decode_param.py. This vulnerability allows for arbitrary code execution by injecting malicious Python expressions into the first line of parameter text files, which are then executed via Python's eval() function. The exploitation can be performed remotely, and public exploit methods are available. Notably, this vulnerability affects products that are no longer supported by the maintainer.
Users are advised to avoid running the 'encode_param' or 'decode_param' commands on parameter directories from untrusted sources. Downstream vendors embedding nnabla CLI should apply a local patch to replace eval() with a safe literal parser, validating the shape header before use.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/3em0/cve_repo/blob/main/2026/Neural-Network-Libraries-(nnabla)%E2%89%A4v1.39.0-Python-eval()-Code-Injection-in-'nnabla_cli%20encode_param'-Leading-to-Arbitrary-Command-Execution.md | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-116103 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1003039 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/426171 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/426171/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Sony Neural Network Libraries | <= 1.39.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |