What is GHSA-38vq-g6vr-w8wf?

GHSA-38vq-g6vr-w8wf is a security advisory published by GitHub Security Advisories with High severity. Sentencepiece has a a heap overflow issue

Which CVE IDs does GHSA-38vq-g6vr-w8wf cover?

GHSA-38vq-g6vr-w8wf covers the following CVE IDs: CVE-2026-1260. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-38vq-g6vr-w8wf?

GHSA-38vq-g6vr-w8wf affects 1 product, including: pip/sentencepiece:\u003c 0.2.1.

GHSA-38vq-g6vr-w8wfHigh

Sentencepiece has a a heap overflow issue

Vendor

GitHub Security Advisories

Published

January 22, 2026

Last Modified

January 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-1260 →

📋 Description

Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.

🎯 Affected products1

pip/sentencepiece:< 0.2.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-1260
https://github.com/google/sentencepiece/releases/tag/v0.2.1
https://github.com/google/sentencepiece/commit/d856b67fdb3492e035489abf9b3aaf486144b2c0
https://github.com/advisories/GHSA-38vq-g6vr-w8wf