Description
A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py. The manipulation of the argument model_lib results in code injection. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Assess Impact
AI Analysis

Impact

The vulnerability is a code injection flaw in the _get_lib_module function of python/mlc_chat/chat_module.py within llSourcell Doctor-Dignity. An attacker can manipulate the model_lib argument to execute arbitrary code. Because the injection can be performed remotely, the flaw enables remote code execution, rated as CWE‑74 and CWE‑94.

Affected Systems

All releases of llSourcell Doctor-Dignity up to commit 3f2ffb6c892f13b50a708d05900d3227acb40ded are potentially affected. The project follows a rolling release model and currently has no fixed release listed, so any deployment may be vulnerable until a patch is released.

Risk and Exploitability

With a CVSS score of 5.3 the vulnerability is considered moderate; no EPSS data is available and it is not listed in CISA KEV. Attackers can exploit the flaw remotely via crafted input, but no publicly available exploit detail is disclosed beyond the PoC. The lack of a timely fix increases risk, so administrators should assess whether they’re running the affected code and plan for a future update or apply mitigations.

Generated by OpenCVE AI on October 19, 2026 at 13:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict the model_lib argument to a whitelist of approved modules and reject any values that are not explicitly allowed.
  • Sanitize all input passed to _get_lib_module to prevent execution of arbitrary code, and ensure that dynamic imports are only performed with validated paths.
  • Monitor the application for unexpected module loading or execution patterns, and log any anomalous activity that could indicate an injection attempt.

Generated by OpenCVE AI on October 19, 2026 at 13:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py. The manipulation of the argument model_lib results in code injection. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Title llSourcell Doctor-Dignity chat_module.py _get_lib_module code injection
First Time appeared Llsourcell
Llsourcell doctor-dignity
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:llsourcell:doctor-dignity:*:*:*:*:*:*:*:*
Vendors & Products Llsourcell
Llsourcell doctor-dignity
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Llsourcell Doctor-dignity
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-19T12:43:12.565Z

Reserved: 2026-10-19T05:18:32.500Z

Link: CVE-2026-112140

cve-icon Vulnrichment

Updated: 2026-10-19T12:42:51.769Z

cve-icon NVD

Status : Deferred

Published: 2026-10-19T12:17:01.740

Modified: 2026-10-19T15:16:45.150

Link: CVE-2026-112140

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T13:30:14Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')