CVE-2026-120334 in farm
Prediction
by VulDB Data Team • 11/01/2026
A flaw has been found in <a href="/product/deepset-ai:farm">deepset-ai farm up to 0.8.0</a>. This impacts the function <code>EmbeddingTokenizer.from_pretrained</code> of the file <em>farm/modeling/tokenization.py</em> of the component <em>Tokenizer Loader</em>. Executing a manipulation of the argument <em>vocab_filename</em> can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.