CVE-2026-112100 in DeepPavlov
Summary
by MITRE • 10/19/2026
A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ of the file deeppavlov/models/preprocessors/multitask_preprocessor.py. This manipulation of the argument preprocessor causes code injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in DeepPavlov versions up to 1.7.0 represents a critical security flaw within the core preprocessing infrastructure, specifically located in the initialization method _init_ of the MultiTaskPipelinePreprocessor class found in the deeppavlov/models/preprocessors/multitask_preprocessor.py module. This component is responsible for preparing and normalizing input data before it is processed by downstream machine learning models. The root cause of this vulnerability lies in how the preprocessor argument is handled during instantiation. When a user or an external system provides a custom preprocessor configuration, the library fails to adequately sanitize or validate the input string that defines the preprocessing logic. This lack of rigorous validation allows for arbitrary code execution through Python's dynamic import and evaluation mechanisms, effectively leading to remote code injection.
From a technical perspective, this flaw aligns with CWE-94 Improper Control of Generation of Code (Code Injection). The vulnerability exploits the fact that many machine learning frameworks allow users to define preprocessing steps via configuration files or API parameters using string-based references to Python modules and functions. If these strings are passed directly into exec() eval(), or dynamic import statements without strict whitelisting, an attacker can inject malicious payloads. In this specific case, the MultiTaskPipelinePreprocessor accepts a preprocessor argument that is likely processed in a way that permits arbitrary Python code execution if crafted correctly. Since DeepPavlov is often deployed as part of larger natural language processing pipelines, these preprocessing steps are frequently triggered by incoming data from untrusted sources such as web forms, API endpoints, or message queues.
The operational impact of this vulnerability is severe due to its remote exploitable nature and the fact that a public exploit has been disclosed. An attacker who can interact with an instance of DeepPavlov running version 1.7.0 or earlier could potentially execute arbitrary commands on the host system where the service is running. This could lead to full compromise of the underlying infrastructure, including data exfiltration, lateral movement within a network, or denial of service through resource exhaustion. The fact that the exploit has been publicly disclosed significantly increases the risk landscape, as automated scanning tools and malicious actors can readily leverage this knowledge to target vulnerable deployments without needing to reverse-engineer the flaw.
This incident also highlights broader risks associated with machine learning libraries that prioritize flexibility over security by allowing dynamic code loading for preprocessing tasks. The vulnerability maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically Python execution, as it allows an attacker to use the system's native scripting capabilities to perform malicious actions. Furthermore, because DeepPavlov is often used in production environments handling sensitive text data, a successful exploitation could also facilitate CWE-200 Exposure of Sensitive Information if the injected code reads local files or network configurations.
Mitigation strategies must be implemented immediately given the public availability of exploits and the lack of response from the project maintainers regarding an official patch. The most effective immediate mitigation is to upgrade DeepPavlov to a version where this issue has been resolved, assuming such a release exists in later versions beyond 1.7.0. If upgrading is not feasible due to compatibility constraints with existing pipelines, organizations should implement strict input validation and sanitization for any preprocessor configurations passed to the MultiTaskPipelinePreprocessor class. This includes restricting allowed module names and function signatures to a predefined whitelist of safe preprocessing operations provided by DeepPavlov itself, rather than allowing arbitrary Python expressions. Additionally, deploying these services within isolated containers or virtual machines with minimal privileges can limit the blast radius in case an exploitation attempt succeeds. Network-level controls such as web application firewalls should also be configured to detect and block payloads containing common code injection patterns associated with Python dynamic execution functions like eval, exec, and _import_.