CVE-2026-122014

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122014", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-11-04T14:31:51.536Z", "datePublished": "2026-11-04T21:00:26.428Z", "dateUpdated": "2026-11-10T15:33:07.173Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-04T21:00:26.428Z"}, "title": "NPC-Worldwide npcpy sft.py load_sft_model code injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "NPC-Worldwide", "product": "npcpy", "versions": [{"version": "2.1.0", "status": "affected"}, {"version": "2.1.1", "status": "affected"}, {"version": "2.1.2", "status": "affected"}, {"version": "2.1.3", "status": "affected"}, {"version": "2.1.4", "status": "affected"}, {"version": "2.1.5", "status": "affected"}, {"version": "2.1.6", "status": "affected"}, {"version": "2.1.7", "status": "affected"}, {"version": "2.1.8", "status": "affected"}, {"version": "2.1.9", "status": "affected"}, {"version": "2.1.10", "status": "affected"}, {"version": "2.1.11", "status": "affected"}, {"version": "2.1.12", "status": "affected"}, {"version": "2.1.13", "status": "affected"}, {"version": "2.1.14", "status": "affected"}, {"version": "2.1.15", "status": "affected"}, {"version": "2.1.16", "status": "affected"}, {"version": "2.1.17", "status": "affected"}, {"version": "2.1.18", "status": "affected"}, {"version": "2.1.19", "status": "affected"}, {"version": "2.1.20", "status": "affected"}, {"version": "2.1.21", "status": "affected"}, {"version": "2.1.22", "status": "affected"}, {"version": "2.1.23", "status": "affected"}, {"version": "2.1.24", "status": "affected"}, {"version": "2.1.25", "status": "affected"}, {"version": "2.1.26", "status": "affected"}, {"version": "2.1.27", "status": "affected"}], "cpes": ["cpe:2.3:a:npc-worldwide:npcpy:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-11-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-11-04T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-04T15:37:10.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Dem000000 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/431082", "name": "VDB-431082 | NPC-Worldwide npcpy sft.py load_sft_model code injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/431082/cti", "name": "VDB-431082 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-122014", "name": "CVE-2026-122014 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1024529", "name": "Submit #1024529 | NPC-Worldwide npcpy 2.1.18 Code Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/NPC-Worldwide/npcpy/issues/308", "tags": ["issue-tracking"]}, {"url": "https://github.com/user-attachments/files/33302468/poc.zip", "tags": ["exploit"]}, {"url": "https://github.com/NPC-Worldwide/npcpy/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202611"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T16:54:34.771507Z", "id": "CVE-2026-122014", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T15:33:07.173Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122014", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-11-04T14:31:51.536Z", "datePublished": "2026-11-04T21:00:26.428Z", "dateUpdated": "2026-11-10T15:33:07.173Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-04T21:00:26.428Z"}, "title": "NPC-Worldwide npcpy sft.py load_sft_model code injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "NPC-Worldwide", "product": "npcpy", "versions": [{"version": "2.1.0", "status": "affected"}, {"version": "2.1.1", "status": "affected"}, {"version": "2.1.2", "status": "affected"}, {"version": "2.1.3", "status": "affected"}, {"version": "2.1.4", "status": "affected"}, {"version": "2.1.5", "status": "affected"}, {"version": "2.1.6", "status": "affected"}, {"version": "2.1.7", "status": "affected"}, {"version": "2.1.8", "status": "affected"}, {"version": "2.1.9", "status": "affected"}, {"version": "2.1.10", "status": "affected"}, {"version": "2.1.11", "status": "affected"}, {"version": "2.1.12", "status": "affected"}, {"version": "2.1.13", "status": "affected"}, {"version": "2.1.14", "status": "affected"}, {"version": "2.1.15", "status": "affected"}, {"version": "2.1.16", "status": "affected"}, {"version": "2.1.17", "status": "affected"}, {"version": "2.1.18", "status": "affected"}, {"version": "2.1.19", "status": "affected"}, {"version": "2.1.20", "status": "affected"}, {"version": "2.1.21", "status": "affected"}, {"version": "2.1.22", "status": "affected"}, {"version": "2.1.23", "status": "affected"}, {"version": "2.1.24", "status": "affected"}, {"version": "2.1.25", "status": "affected"}, {"version": "2.1.26", "status": "affected"}, {"version": "2.1.27", "status": "affected"}], "cpes": ["cpe:2.3:a:npc-worldwide:npcpy:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-11-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-11-04T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-04T15:37:10.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Dem000000 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/431082", "name": "VDB-431082 | NPC-Worldwide npcpy sft.py load_sft_model code injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/431082/cti", "name": "VDB-431082 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-122014", "name": "CVE-2026-122014 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1024529", "name": "Submit #1024529 | NPC-Worldwide npcpy 2.1.18 Code Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/NPC-Worldwide/npcpy/issues/308", "tags": ["issue-tracking"]}, {"url": "https://github.com/user-attachments/files/33302468/poc.zip", "tags": ["exploit"]}, {"url": "https://github.com/NPC-Worldwide/npcpy/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202611"]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-122014", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T16:54:34.771507Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T16:58:45.416Z"}}]}}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:npc-worldwide:npcpy:*:*:*:*:*:*:*:*"], "product": "npcpy", "vendor": "NPC-Worldwide", "versions": [{"status": "affected", "version": "2.1.0"}, {"status": "affected", "version": "2.1.1"}, {"status": "affected", "version": "2.1.2"}, {"status": "affected", "version": "2.1.3"}, {"status": "affected", "version": "2.1.4"}, {"status": "affected", "version": "2.1.5"}, {"status": "affected", "version": "2.1.6"}, {"status": "affected", "version": "2.1.7"}, {"status": "affected", "version": "2.1.8"}, {"status": "affected", "version": "2.1.9"}, {"status": "affected", "version": "2.1.10"}, {"status": "affected", "version": "2.1.11"}, {"status": "affected", "version": "2.1.12"}, {"status": "affected", "version": "2.1.13"}, {"status": "affected", "version": "2.1.14"}, {"status": "affected", "version": "2.1.15"}, {"status": "affected", "version": "2.1.16"}, {"status": "affected", "version": "2.1.17"}, {"status": "affected", "version": "2.1.18"}, {"status": "affected", "version": "2.1.19"}, {"status": "affected", "version": "2.1.20"}, {"status": "affected", "version": "2.1.21"}, {"status": "affected", "version": "2.1.22"}, {"status": "affected", "version": "2.1.23"}, {"status": "affected", "version": "2.1.24"}, {"status": "affected", "version": "2.1.25"}, {"status": "affected", "version": "2.1.26"}, {"status": "affected", "version": "2.1.27"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."}], "id": "CVE-2026-122014", "lastModified": "2026-11-10T16:17:18.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-122014", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T16:54:34.771507Z", "version": "2.0.3"}}]}, "published": "2026-11-04T21:18:07.777", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/NPC-Worldwide/npcpy/"}, {"source": "cna@vuldb.com", "url": "https://github.com/NPC-Worldwide/npcpy/issues/308"}, {"source": "cna@vuldb.com", "url": "https://github.com/user-attachments/files/33302468/poc.zip"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-122014"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/1024529"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431082"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431082/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "npcpy: npcpy: Arbitrary code execution via manipulated model path parameter", "id": "2567504", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567504"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-94", "details": ["A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", "A flaw was found in npcpy. An input validation vulnerability in the model loading component allows a remote attacker to execute arbitrary code. By supplying a specially crafted model name or path parameter, an attacker can inject and execute unintended commands within the application's runtime environment."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122014", "public_date": "2026-11-04T21:00:26Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122014\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122014\nhttps://github.com/NPC-Worldwide/npcpy/\nhttps://github.com/NPC-Worldwide/npcpy/issues/308\nhttps://github.com/user-attachments/files/33302468/poc.zip\nhttps://vuldb.com/cve/CVE-2026-122014\nhttps://vuldb.com/submit/1024529\nhttps://vuldb.com/vuln/431082\nhttps://vuldb.com/vuln/431082/cti"], "statement": "This vulnerability is rated as an Important impact because successful exploitation permits arbitrary code execution with the privileges of the running application, compromising host integrity and confidentiality. Although an attacker could achieve complete control over the application environment, exploitation relies on inducing the application or user to load a model from an untrusted source or manipulated path. Red Hat products do not include or distribute this component by default, limiting the potential attack surface across standard enterprise deployments.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.17"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.19"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.22"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.23"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.24"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.25"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.26"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.27"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "npcpy", "source": "cna", "vendor": "NPC-Worldwide"}, "product": "npcpy", "vendor": "npc-worldwide"}], "created": "2026-11-04T23:00:21.133867+00:00", "updated": "2026-11-06T21:28:16.435813+00:00", "vendors": ["npc-worldwide", "npc-worldwide$PRODUCT$npcpy"]}