CVE-2026-112098 in DeepPavlov
Summary
by MITRE • 10/19/2026
A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
A critical security vulnerability has been identified within DeepPavlov, specifically affecting versions up to 1.7.0, which is a popular open-source library designed for building deep learning models and pipelines for natural language processing tasks. The flaw resides in the resolve function located within the deeppavlov/core/common/params.py file, which serves as part of the Config Reference Resolver component responsible for parsing configuration files that define model architectures and pipeline parameters. This vulnerability allows an attacker to achieve arbitrary code execution through a technique classified under CWE-94 Improper Control of Generation of Code or Script, commonly known as code injection. The root cause lies in how the resolver processes user-supplied input within configuration structures without adequate sanitization or validation mechanisms before evaluating them as Python expressions.
The operational impact of this vulnerability is severe due to its remote exploitable nature and the potential for full system compromise if DeepPavlov is deployed on a server with internet access. Attackers can craft malicious configuration files containing specially crafted payloads that, when processed by the vulnerable resolve function, result in the execution of arbitrary commands on the host machine. This capability effectively bypasses standard security boundaries because the code executes within the context of the application process, inheriting its permissions and environment variables. The fact that an exploit has already been released to the public significantly increases the risk landscape, as automated scanning tools and malicious actors can readily leverage this knowledge to target vulnerable instances without needing to develop custom attack vectors from scratch.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter, where adversaries use system utilities or scripting languages to execute commands during post-exploitation phases. In the context of DeepPavlov, the configuration parsing stage acts as the initial attack vector that facilitates subsequent lateral movement or data exfiltration depending on the deployment environment. The lack of a timely response from the project maintainers despite early notification through issue reports exacerbates the risk for users who may be relying on default configurations or third-party models distributed with pre-packaged settings, thereby exposing them to potential compromise without their immediate awareness.
Mitigation strategies must prioritize immediate isolation and configuration review until an official patch is released by the DeepPavlov maintainers. Organizations deploying this software should audit all external configuration files for any dynamic expression evaluation patterns that could be manipulated via user input. Implementing strict allow-lists for permitted parameters or disabling remote loading of untrusted configurations can significantly reduce the attack surface. Additionally, running DeepPavlov instances with minimal privileges and within isolated containerized environments limits the blast radius in case an exploitation attempt succeeds. Continuous monitoring for anomalous process executions originating from Python processes associated with NLP pipelines is also recommended to detect potential abuse attempts early.