Live › vulnerability › CVE-2026-112098
Go to dashboardDeepPavlov, an open-source NLP and conversational AI framework, has a code injection flaw in its config reference resolver (the resolve function in deeppavlov/core/common/params.py) in versions up to 1.7.0. A remote attacker who can supply crafted configuration input may get code executed on the host running it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running DeepPavlov 1.7.0 or earlier are exposed, most likely where the framework parses configuration or reference strings that come from outside the team. Systems that use DeepPavlov only with fixed, internally written configs are less exposed, but the sources do not confirm which input reaches the vulnerable function.
No product ranges from the sources yet.
pip show deeppavlov and treat anything at or below 1.7.0 as affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112098")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.