| Title | Sony NNabla 1.39.0 (final release; commit cbf0545b verified) Code Injection |
|---|
| Description | A vulnerability was found in Sony NNabla 1.39.0 and classified as high 8.8.
Affected is the func_set_nnabla_version_decorate function of the NNP converter
component (python/src/nnabla/utils/converter/utils.py). The manipulation of the
argument function.type leads to code injection (CWE-94). It is possible to
launch the attack remotely. User interaction is required because a victim must
run the documented nnabla_cli convert command on a crafted .nnp model file.
Technical Details
- Affected file/function: python/src/nnabla/utils/converter/utils.py /
func_set_nnabla_version_decorate() (eval at lines 111 and 116); gate
func_set_import_nnp() at lines 352-356 checks only the first network with a
given name, while the decorator iterates all same-name networks
- Vulnerable parameter: function.type field of the NNP network protobuf
- Attack vector: Network (crafted model file delivered remotely)
- Privileges required: None
- Trigger condition: victim converts an attacker-supplied .nnp file with
`nnabla_cli convert malicious.nnp out.nnp --nnp-version 1.39.0`. The file
contains two networks with the same name; the benign first network passes
the version gate, and the second network's function.type is concatenated
into eval() (payload of the form `__class__ and 0 or
__import__('os').system('<cmd>')`). The command executes; a subsequent
KeyError (unknown-type lookup) crashes the process afterwards (exit 255)
without undoing the execution. Verified end-to-end in Docker (ubuntu:22.04)
against the official nnabla==1.39.0 PyPI package with runtime network
disabled; the master branch still contains the vulnerable eval() calls as
of 2026-09-24.
Impact
- Confidentiality: High (arbitrary code execution in the converting user's context)
- Integrity: High (arbitrary file modification possible)
- Availability: High (arbitrary process termination/interference possible)
CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
- Discovered: [unknown]
- Vendor notified: [pending — private contact attempted via Sony HackerOne;
the GitHub repository is archived read-only since 2026-07-29 and provides
no security policy or private reporting channel]
- Patch released: [pending — not expected upstream; the project is EOL and
v1.39.0 (2024-05-29) is the final release]
- Public disclosure: [pending]
Countermeasure
Replace the eval()-based parameter probing with safe attribute lookup
(hasattr/getattr on the protobuf function object), validate function.type
against the set of known function types before processing, and reject
duplicate network names at parse time. As no upstream fix is expected, users
should not convert .nnp files from untrusted sources with nnabla_cli until a
patched fork exists. |
|---|
| Source | ⚠️ https://github.com/3em0/cve_repo/blob/main/2026/Sony-NNabla-1.39.0-Code-Injection-in-NNP-Converter-('function.type'-eval()).md |
|---|
| User | r1ck99 (UID 100733) |
|---|
| Submission | 09/27/2026 07:38 (1 month ago) |
|---|
| Moderation | 10/25/2026 08:37 (28 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426172 [Sony Neural Network Libraries up to 1.39.0 NNP Converter utils.py func_set_nnabla_version_decorate function.type code injection] |
|---|
| Points | 20 |
|---|