CVE-2026-112098: DeepPavlov Config Reference Resolver params.py resolve code injection
A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which DeepPavlov versions are known to be affected?
DeepPavlov versions up to and including 1.7.0 are identified as impacted. No fixed version is provided.
Does exploitation require authentication or user interaction?
The vulnerability is remotely reachable and does not require attacker privileges. However, the supplied vector indicates that user interaction is required.
Is exploitation likely to be practical?
A public exploit has been released, and the exploit maturity is rated as proof-of-concept. This increases the likelihood of attempted exploitation where an attacker can induce the required user interaction.
Is a vendor remediation available?
The available information does not identify a patch or other remediation. It states that the project was notified through an issue report but had not responded at the time of publication.