braindecode up to 1.8.1 Model Config Deserialization util.py resolve_type_kwargs activation externally-controlled input to select classes or code

Summaryinfo

A vulnerability marked as critical has been reported in braindecode up to 1.8.1. Affected by this vulnerability is the function resolve_type_kwargs of the file braindecode/models/util.py of the component Model Config Deserialization. Performing a manipulation of the argument Activation results in use of externally-controlled input to select classes or code. This vulnerability was named CVE-2026-126994. The attack may be initiated remotely. In addition, an exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in braindecode up to 1.8.1. This affects the function resolve_type_kwargs of the file braindecode/models/util.py of the component Model Config Deserialization. The manipulation of the argument activation with an unknown input leads to a use of externally-controlled input to select classes or code vulnerability. CWE is classifying the issue as CWE-470. The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. This is going to have an impact on confidentiality, integrity, and availability.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-126994. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details and a public exploit are known.

The exploit is shared for download at github.com. It is declared as proof-of-concept.

Upgrading to version 2.0.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 05b764d93b9a50400f523206fbe03d73d0cf5edb is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• braindecode

Version

• 1.8.0
• 1.8.1

License

• open-source

Website

• Product: https://github.com/braindecode/braindecode/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #1040635: braindecode 1.4.0 to 1.8.1 (commit adaa63a8ac7510d0976ee134f6a9ff8e916ef37d) Unsafe Reflection (by Dem00000)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion