Search results

Security: LLM-directed arbitrary shell/Python execution via _tool_sh() and _tool_python()

Status: Open.

#217 In NPC-Worldwide/npcpy;

· CrepuscularIRIS opened on Apr 13, 2026

Security: Shell command injection via desktop.py subprocess.Popen with shell=True

Status: Open.

#216 In NPC-Worldwide/npcpy;

· CrepuscularIRIS opened on Apr 13, 2026

Security: Unrestricted exec() of generated code in npc_compiler.py with full builtins

Status: Open.

#215 In NPC-Worldwide/npcpy;

· CrepuscularIRIS opened on Apr 13, 2026

Bug: kg_initial() drops implied facts — zoom_in_enabled defaults to False

Status: Open.

#214 In NPC-Worldwide/npcpy;

· CrepuscularIRIS opened on Apr 13, 2026

Bug: NPC._setup_db() crashes with sqlite3.Connection — expects SQLAlchemy engine

Status: Open.

#213 In NPC-Worldwide/npcpy;

· CrepuscularIRIS opened on Apr 13, 2026

Bug: NameError crash in get_ollama_response when ollama package not installed

Status: Open.

#212 In NPC-Worldwide/npcpy;

· CrepuscularIRIS opened on Apr 13, 2026

[feat] update image tooling for more extensive image editing with local models

Status: Open.

#201 In NPC-Worldwide/npcpy;

· cagostino opened on Feb 19, 2026

Potential Remote Code Execution via torch.load in load_diamond_model

Status: Open.

#200 In NPC-Worldwide/npcpy;

· Doria77486 opened on Jan 30, 2026

Unsafe deserialization in deserialize_model leads to arbitrary code execution via pickle.loads

Status: Open.

#198 In NPC-Worldwide/npcpy;

· Doria77486 opened on Jan 15, 2026

Untrusted Jinx templates lead to Jinja2 template injection and arbitrary code execution

Status: Open.

#197 In NPC-Worldwide/npcpy;

· Doria77486 opened on Jan 15, 2026

[feat] jinx <-> npc array / compute graph interops

Status: Open.

#196 In NPC-Worldwide/npcpy;

· cagostino opened on Nov 28, 2025

[feat] auto discover models from common hosting endpoints (lm studio, llama cpp, mlx)

Status: Open.

#193 In NPC-Worldwide/npcpy;

· cagostino opened on Nov 17, 2025