A vulnerability (CVE-2026-126995) was discovered in tjake Jlama versions up to 0.8.4 and 0.9.0-beta affecting the SafeTensorIndex.loadWeights function in SafeTensorIndex.java. The vulnerability allows for path traversal via manipulation of the weightmap argument, making it susceptible to remote attacks. An exploit has been publicly disclosed and the project has not yet responded to an early issue report. This vulnerability matters to people building or operating AI agents using tjake Jlama as it may allow unauthorized access to sensitive data or system resources.