CVE-2026-112098
MediumCVSS 6.3Summary
A security flaw was discovered in DeepPavlov up to 1.7.0 affecting the resolve function in deeppavlov/core/common/params.py within the Config Reference Resolver component. Manipulation leads to code injection, and the attack can be launched remotely. The exploit has been released publicly and the project has not yet responded to the issue report.
Risk Assessment
A remote attacker can use the public exploit to inject code in applications using DeepPavlov, potentially leading to arbitrary code execution. The project's lack of response increases the risk of prolonged exposure.
Recommendation
Restrict or validate input passed to the resolve function and consider applying a custom fix or isolating the component. Monitor the issue and update the library when a patched version becomes available.
Other vulnerabilities in DeepPavlov
See all- CVE-2026-112100Medium
A vulnerability was determined in DeepPavlov up to 1.7.0 affecting the MultiTaskPipelinePreprocessor.__init__ function in deeppavlov/models/preprocessors/multitask_preprocessor.py. Manipulating the preprocessor argument causes code injection, and the attack can be carried out remotely. The exploit has been publicly disclosed and the project has not yet responded to the issue report.
- CVE-2026-109155Medium
A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.
Original NVD description (English source)
A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS