Submit #1011308: AllenAI AllenNLP 2.10.1 Use of Externally-Controlled Input to Select Classes or Code

A vulnerability was found in AllenNLP 2.10.1 (commit 80fb6061e568cb9d6ab5d45b661e86eb61b92c82, the final state of the archived repository) and classified as high 7.8. Affected is the FromParams/Registrable configuration machinery (allennlp/common/params.py Params.pop_choice, allennlp/common/registrable.py Registrable.resolve_class_name, allennlp/common/from_params.py FromParams.construct). The manipulation of the argument type in the dataset_reader stanza of a model archive config.json leads to unsafe reflective instantiation and arbitrary command execution. It is possible to launch the attack remotely: a victim only needs to run allennlp predict (or train) on an attacker-supplied model.tar.gz.

Technical Details
- Affected file/function: allennlp/common/params.py pop_choice (allow_class_names=True accepts any dotted value as a class name); allennlp/common/registrable.py resolve_class_name (importlib.import_module + getattr with no subclass validation); allennlp/common/from_params.py construct (return subclass(**params))
- Vulnerable parameter: dataset_reader.type (and any other registered type field) in config.json inside model.tar.gz
- Attack vector: Network
- Privileges required: None
- User interaction: Required (victim runs the CLI on the crafted archive; automated model-evaluation pipelines would remove this)
- Trigger condition: dataset_reader.type = subprocess.Popen with an args parameter, e.g. ["python3", "-c", "<payload>"]; the command executes during archive loading, before model weights are loaded. Archive contents themselves are not importable (temp dir not on sys.path), so the primitive is limited to modules importable in the victim environment; the Python standard library is sufficient.

Impact
- Confidentiality: High (arbitrary read/exfiltration with the victim user's privileges)
- Integrity: High (arbitrary file creation/modification)
- Availability: High (arbitrary process creation/destruction)

CVSS v3.1
Score: 7.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline
- Discovered: 2026-10-01
- Vendor notified: [not possible - repository archived 2022-11-22, issues closed, no security contact published]
- Patch released: [not expected - project end-of-life]
- Public disclosure: [pending]

Countermeasure
The project is end-of-life and no upstream fix is expected; operators should migrate off AllenNLP or isolate it (unprivileged container, no secrets, no untrusted archives). The natural upstream fix would be to validate the object resolved by Registrable.resolve_class_name (reject unless isinstance(subclass, type) and issubclass(subclass, cls)) and/or disable the allow_class_names leniency for untrusted configuration.

• Source: ⚠️ https://github.com/3em0/cve_repo/blob/main/2026/AllenNLP_2.10.1_Unsafe_Reflective_Instantiation_RCE_in_FromParams_Configuration_Handling.md
• User: r1ck9 (UID 97869)
• Submission: 10/02/2026 12:52 (23 days ago)
• Moderation: 10/25/2026 19:14 (23 days later)
• Status: Accepted
• VulDB entry: 426304 [AllenAI AllenNLP up to 2.10.1 Registrable Configuration Machinery registrable.py Registrable.resolve_class_name type code injection]
• Points: 20