| Title | Sony Neural Network Libraries (nnabla) up to 1.39.0 Code Injection |
|---|
| Description | A vulnerability was found in Neural Network Libraries (nnabla) up to 1.39.0 and
classified as high 8.8. Affected is the load_param_in_txt function of the
nnabla_cli encode_param command component (python/src/nnabla/utils/cli/
encode_decode_param.py). The manipulation of the shape header line of a plain-text
parameter file leads to code injection: the header string is passed to Python's
eval() without validation, so a crafted parameter directory executes arbitrary
Python and OS commands. It is possible to launch the attack remotely; user
interaction is required because the victim must run the documented command
nnabla_cli encode_param -i <dir> -p <out>.h5 on an attacker-supplied directory.
The payload returns a legal shape value, so the command completes with exit code 0.
Technical Details
- Affected file/function: python/src/nnabla/utils/cli/encode_decode_param.py /
load_param_in_txt() (eval at line 37)
- Vulnerable parameter: first line (tensor shape header) of each .txt parameter
file in the input directory
- Attack vector: Network (malicious parameter directory delivered via download,
model hub, or git repository)
- Privileges required: None
- Trigger condition: victim runs nnabla_cli encode_param on an untrusted parameter
directory; each file's first line is evaluated by eval()
Impact
- Confidentiality: High (arbitrary read under the victim user)
- Integrity: High (arbitrary file write/modify)
- Availability: High (arbitrary code can disrupt the host)
CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
- Discovered: 2026-09-24
- Vendor notified: [pending] (via https://secure.sony.com/ / HackerOne sony;
GitHub repository was archived on 2026-07-29 and offers no private channel)
- Patch released: none expected (project end-of-life announced 2025-04-03)
- Public disclosure: [pending]
Countermeasure
Replace eval() with ast.literal_eval() and validate that the result is a list or
tuple of non-negative integers before constructing nn.Variable. Until patched,
do not run nnabla_cli encode_param on parameter directories from untrusted
sources; downstream vendors embedding the CLI should patch locally. |
|---|
| Source | ⚠️ https://github.com/3em0/cve_repo/blob/main/2026/Neural-Network-Libraries-(nnabla)%E2%89%A4v1.39.0-Python-eval()-Code-Injection-in-'nnabla_cli%20encode_param'-Leading-to-Arbitrary-Command-Execution.md |
|---|
| User | r1ck99 (UID 100733) |
|---|
| Submission | 09/27/2026 07:22 (1 month ago) |
|---|
| Moderation | 10/25/2026 08:37 (28 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426171 [Sony Neural Network Libraries up to 1.39.0 Encode Param Command encode_decode_param.py load_param_in_txt code injection] |
|---|
| Points | 20 |
|---|