MediumVulnerability
CVE-2026-116103: Sony Neural Network Libraries code injection in encode param command handler
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-116103
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
A vulnerability in Sony Neural Network Libraries up to 1.39.0 affects the function load_param_in_txt in python/src/nnabla/utils/cli/encode_decode_param.py, within the Encode Param Command Handler component. Manipulating it leads to code injection, and the attack can be launched remotely. A public exploit is available and might be used.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumCVE-2026-116104: Sony Neural Network Libraries code injection in NNP ConverterSimilar attack · NVD/CVE Database
- MediumPHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted HackingSimilar attack · The Hacker News
- HighCVE-2026-116176: vLLM server-side request forgery via X-Request-Id decode addressSimilar attack · NVD/CVE Database
- InfoOpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox CommunicationSimilar attack · The Hacker News
- MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSimilar attack · GitHub Advisory Database