DeepPavlov vulnerabilities

A vulnerability was determined in DeepPavlov up to 1.7.0 affecting the MultiTaskPipelinePreprocessor.__init__ function in deeppavlov/models/preprocessors/multitask_preprocessor.py. Manipulating the preprocessor argument causes code injection, and the attack can be carried out remotely. The exploit has been publicly disclosed and the project has not yet responded to the issue report.

A security flaw was discovered in DeepPavlov up to 1.7.0 affecting the resolve function in deeppavlov/core/common/params.py within the Config Reference Resolver component. Manipulation leads to code injection, and the attack can be launched remotely. The exploit has been released publicly and the project has not yet responded to the issue report.

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.