Submit #1012820: AXA Group NLP.js 4.27.0 (commit 62731109b5dc5d9ed727c6e599443fb29eaea798) Code Injection

A vulnerability was found in NLP.js 4.27.0 (commit 62731109b5dc5d9ed727c6e599443fb29eaea798; @nlpjs/evaluator 4.26.1, @nlpjs/nlp 4.27.0, @nlpjs/basic 4.27.0) and classified as high 8.8. Affected is the condition-expression pipeline of the NLG manager: the Evaluator interpret pass in packages/evaluator/src/evaluator.js (Evaluator.walkIdentifier and Evaluator.walkFunction, lines 140-145 and 218-241) resolves unknown identifiers such as `process` to `undefined` instead of rejecting them, after which the same expression text is compiled with the Function constructor in the Node.js global scope and executed by the NlgManager.filterAnswers answer filter (packages/nlg/src/nlg-manager.js, lines 64-94) for every answer loaded from a model.nlp file. The manipulation of the argument condition leads to code injection with the privileges of the bot process while the bot keeps answering normally. It is possible to launch the attack remotely: an attacker who supplies a crafted model.nlp to a deployment that loads it (the documented qna-web / Directline pattern auto-loads the file at boot) achieves arbitrary code execution. The malicious model is generated with the official train()/save() API and contains no script or sidecar; the only semantic difference from a benign model is the condition string stored at the JSON pointer /nlgManager/responses/<locale>/<intent>/0/opts/condition.

Technical Details
- Affected file/function: packages/evaluator/src/evaluator.js / Evaluator.walkFunction (Function-compile fallback), reached via packages/nlg/src/nlg-manager.js / NlgManager.filterAnswers
- Vulnerable parameter: opts.condition of NLG answers inside the model.nlp JSON file
- Attack vector: Network
- Privileges required: None
- User interaction: Required (an operator deploys/loads the crafted model file; if models load automatically from attacker-influenced locations the rating rises to 9.8)
- Trigger condition: victim loads the malicious model.nlp and processes any utterance that selects the conditioned answer

Impact
- Confidentiality: High (expression code runs with full Node.js capability of the bot process, arbitrary reads and module access via process.mainModule.require)
- Integrity: High (demonstrated arbitrary file write with bot-process privileges)
- Availability: High (injected code controls the bot process)

CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline
- Discovered: 2026-10-02
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Treat model.nlp as code: stop evaluating condition strings from loaded model files or gate them behind signed/trusted models; in @nlpjs/evaluator make the interpret phase fail closed on identifiers absent from the caller context (walkIdentifier currently returns undefined) and remove the Function-compile fallback in walkFunction or compile against an isolated context exposing only the caller context.

• Source: ⚠️ https://github.com/axa-group/nlp.js/issues/1380
• User: Dem0000000 (UID 98743)
• Submission: 10/03/2026 17:30 (15 days ago)
• Moderation: 10/18/2026 19:33 (15 days later)
• Status: Accepted
• VulDB entry: 421981 [AXA Group NLP.js 4.27.0 Condition Expression Pipeline evaluator.js Evaluator.walkFunction condition code injection]
• Points: 20