CVE-2026-112100: DeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.__init__ code injection
Published Oct 19, 2026
·Updated
A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.init of the file deeppavlov/models/preprocessors/multitaskpreprocessor.py. This manipulation of the argument preprocessor causes code injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
1 affected component
DeepPavlov DeepPavlov<=1.7.0
Event History
Oct 19, 2026
CVE Published
via MITRE·09:15 AM
Data Sourced
via MITRE·09:15 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low privileges and user interaction. The attack can be conducted remotely.
2
Which DeepPavlov versions are reported as affected?
The vulnerability is reported to affect DeepPavlov versions up to 1.7.0.
3
Is exploit information publicly available?
Yes. The exploit has been publicly disclosed and may be used by attackers.