CVE-2026-120335 deepset-ai CVE debrief

Who should care

Defenders and administrators of systems using deepset-ai farm version 0.8.0 or earlier, especially in local deployment contexts, should assess exposure and prioritize verification and potential remediation for this vulnerability.

Why it matters

CVE-2026-120335 is a path traversal vulnerability in deepset-ai farm up to version 0.8.0, allowing local attackers to manipulate file paths. Although publicly disclosed, the vendor did not respond, and there is limited information about potential exploits or impacts. Defenders should assess exposure, prioritize verification, and consider remediation or compensating controls.

• Verify potential exposure to path traversal attacks in local deployments.
• Assess the impact of unauthorized file access on your system.
• Prioritize remediation or compensating controls for affected systems.
• Monitor for suspicious activity related to the deepset-ai farm.

Technical summary

The WordEmbedding_LM.load function in farm/modeling/language_model.py is vulnerable to path traversal attacks, allowing local attackers to manipulate the embeddings_filename argument. This issue affects deepset-ai farm up to version 0.8.0 and has been publicly disclosed. The vulnerability can lead to unauthorized file access, and defenders should assess exposure and prioritize verification and potential remediation for this vulnerability. The vendor did not respond to the disclosure, and there is limited information about potential exploits or impacts.

Defensive priority

Assess exposure and prioritize verification for systems using deepset-ai farm version 0.8.0 or earlier, especially in local deployment contexts.

Recommended defensive actions

• Review and verify the deepset-ai farm version in use, especially for local deployments.
• Assess the potential impact of path traversal on your system.
• Consider compensating controls or monitoring for suspicious activity.
• Prioritize verification and potential remediation for this vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected versions. However, the vendor did not respond to the disclosure, and there is limited information about potential exploits or impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.