PT-2026-117373

CVE-2026-112140

Published

2026-10-19

Updated

2026-10-19

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions llSourcell Doctor-Dignity versions prior to 3f2ffb6c892f13b50a708d05900d3227acb40ded

Description Remote code injection is possible through the manipulation of the model lib argument within the get lib module() function located in the python/mlc chat/chat module.py file.

Recommendations As a temporary workaround, restrict the use of the model lib argument in the get lib module() function until a fix is released.

Exploitability

Exploit

Fix

Impacts

Researchers

Dem0000000

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers