Submit #1012810: DeepPavlov up to 1.7.0 (commit 5f9fbed0c7191466bc7621e604b810f66f254c03, code still present in master) Code Injection

A vulnerability was found in DeepPavlov up to 1.7.0 and classified as high 8.8. Affected is the function resolve() of the config reference resolver component in deeppavlov/core/common/params.py. The manipulation of the argument reference expression (a config string value starting with #) leads to code injection through the unrestricted use of eval(). It is possible to launch the attack remotely. User interaction is required because a crafted model configuration file must be processed by a DeepPavlov command that builds a model (predict, train, interact, riseapi or risesocket).

Technical Details
- Affected file/function: deeppavlov/core/common/params.py / resolve(), reached from from_params() and build_model()
- Vulnerable parameter: any string config value starting with # (component reference expression), e.g. an ordinary component parameter in the chainer pipe
- Attack vector: Network
- Privileges required: None
- Trigger condition: the victim builds a model from a crafted configuration file; the expression after the # prefix is re-joined and passed to eval(), so a payload such as #tok.__init__.__globals__['__builtins__']['__import__']('pathlib')... executes at build time. The expression can return a plain boolean so inference proceeds normally and the execution stays silent. No custom code file or pickle inside the model package is required.

Impact
- Confidentiality: High (arbitrary read through embedded __import__)
- Integrity: High (arbitrary file write demonstrated by the PoC)
- Availability: High (arbitrary code can terminate or destabilize the process)

CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline
- Discovered: [unknown]
- Vendor notified: [pending]
- Patch released: [pending] (code still present in master as of 2026-10-02)
- Public disclosure: [pending]

Countermeasure
Replace eval() in resolve() with a strictly validated attribute walk: validate the reference expression against a dotted-identifier grammar and resolve it with repeated getattr() only; reject subscripts and calls with ConfigError. Until a fix is released, do not build models from configuration files obtained from untrusted sources.

• Source: ⚠️ https://github.com/deeppavlov/DeepPavlov/issues/1713
• User: Dem0000000 (UID 98743)
• Submission: 10/03/2026 16:52 (15 days ago)
• Moderation: 10/18/2026 19:17 (15 days later)
• Status: Accepted
• VulDB entry: 421933 [DeepPavlov up to 1.7.0 Config Reference Resolver params.py resolve code injection]
• Points: 20