Submit #1012812: DeepPavlov 1.2.0 - 1.7.0 (latest PyPI release) and master @ commit 5f9fbed Code Injection

A vulnerability was found in DeepPavlov 1.2.0 through 1.7.0 and master (commit 5f9fbed0c7191466bc7621e604b810f66f254c03) and classified as high 8.8. Affected is the MultiTaskPipelinePreprocessor component (registered as multitask_pipeline_preprocessor) in deeppavlov/models/preprocessors/multitask_preprocessor.py. The manipulation of the argument preprocessor leads to code injection: the config.json field, documented as a DeepPavlov class name, is evaluated with eval() and the result is immediately called. It is possible to launch the attack remotely; user interaction is required because the victim must load a delivered model package with the standard deeppavlov.build_model() / deeppavlov predict entry points.

Technical Details
- Affected file/function: deeppavlov/models/preprocessors/multitask_preprocessor.py:46-47 (MultiTaskPipelinePreprocessor.__init__); the same eval pattern exists in the preprocessors list branch at line 51
- Vulnerable parameter: preprocessor field of the component entry in config.json
- Attack vector: Network (model packages are obtained over the network; attacker supplies a crafted package containing only JSON and tokenizer data files, no .py sidecar)
- Privileges required: None
- Trigger condition: victim builds a model from the attacker's config.json via deeppavlov.build_model() / deeppavlov predict -c; the eval'ed expression executes inside the victim process and can still return the legitimate TorchTransformersPreprocessor class, so construction and prediction continue normally and silently (verified end-to-end with a canary file write; token ids identical to the negative control that differs only in this single JSON leaf)

Impact
- Confidentiality: High (arbitrary Python execution in the victim process exposes all data readable by that user)
- Integrity: High (arbitrary file write/overwrite demonstrated)
- Availability: High (arbitrary code can crash or persist)

CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline
- Discovered: 2026-10-02
- Vendor notified: [pending]
- Patch released: [pending] (master still contains eval(preprocessor) as of 2026-10-02)
- Public disclosure: [pending]

Countermeasure
Resolve the documented class name through the existing component registry or the cls_from_str() module:Class parser with a namespace allowlist instead of eval(), in both the single-field branch (line 46) and the list branch (line 51); until patched, do not load model configs from untrusted sources.

• Source: ⚠️ https://github.com/deeppavlov/DeepPavlov/issues/1714
• User: Dem0000000 (UID 98743)
• Submission: 10/03/2026 17:01 (15 days ago)
• Moderation: 10/18/2026 19:25 (15 days later)
• Status: Accepted
• VulDB entry: 421958 [DeepPavlov up to 1.7.0 multitask_preprocessor.py MultiTaskPipelinePreprocessor.__init__ preprocessor code injection]
• Points: 20