CVE-2026-112100
MediumCVSS 5.5Summary
A vulnerability was determined in DeepPavlov up to 1.7.0 affecting the MultiTaskPipelinePreprocessor.__init__ function in deeppavlov/models/preprocessors/multitask_preprocessor.py. Manipulating the preprocessor argument causes code injection, and the attack can be carried out remotely. The exploit has been publicly disclosed and the project has not yet responded to the issue report.
Risk Assessment
A remote attacker can use the public exploit to inject code in applications using DeepPavlov, potentially leading to arbitrary code execution. The project's lack of response increases the risk of prolonged exposure.
Recommendation
Restrict or validate input passed to MultiTaskPipelinePreprocessor and consider applying a custom fix or isolating the component. Monitor the issue and update the library when a patched version becomes available.
Other vulnerabilities in DeepPavlov
See all- CVE-2026-112098Medium
A security flaw was discovered in DeepPavlov up to 1.7.0 affecting the resolve function in deeppavlov/core/common/params.py within the Config Reference Resolver component. Manipulation leads to code injection, and the attack can be launched remotely. The exploit has been released publicly and the project has not yet responded to the issue report.
- CVE-2026-109155Medium
A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.
Original NVD description (English source)
A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ of the file deeppavlov/models/preprocessors/multitask_preprocessor.py. This manipulation of the argument preprocessor causes code injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS