{"id":"CVE-2026-112098","kind":"vulnerability","aliases":["CVE-2026-112098"],"related":[],"title":"DeepPavlov: config reference resolver flaw allows remote code injection","description":"A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","summary":"DeepPavlov, an open-source NLP and conversational AI framework, has a code injection flaw in its config reference resolver (the resolve function in deeppavlov/core/common/params.py) in versions up to 1.7.0. A remote attacker who can supply crafted configuration input may get code executed on the host running it.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","deeppavlov","python","self-hosted"],"not_affected_if":["fixed-internal-configs"],"how_to_check":"- Check the installed DeepPavlov version with `pip show deeppavlov` and treat anything at or below `1.7.0` as affected.\n- Look for code that loads DeepPavlov configs from untrusted or user-supplied input.\n- unknown whether the sources give a specific trigger path beyond the resolve function.","fix":"- unknown: the sources say the project has not responded and no fixed version is listed.\n- Until a fix is released, avoid loading configuration from untrusted input and restrict network access to services running DeepPavlov.","status":"open","published_at":"2026-10-19T09:17:07+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:23:19+00:00","updated_at":"2026-10-25T03:23:19+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T03:23:19Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources say the project has not responded and no fixed version is listed.\n- Until a fix is released, avoid loading configuration from untrusted input and restrict network access to services running DeepPavlov.","reach":"internet","title":"DeepPavlov: config reference resolver flaw allows remote code injection","impact":"high","summary":"DeepPavlov, an open-source NLP and conversational AI framework, has a code injection flaw in its config reference resolver (the resolve function in deeppavlov/core/common/params.py) in versions up to 1.7.0. A remote attacker who can supply crafted configuration input may get code executed on the host running it.","category":"ai-tooling","nicknames":[],"who_cares":["python","deeppavlov","ai-tooling","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the server hosting DeepPavlov.","analyst_note":"Confirm the exact input that reaches resolve() and whether a fixed version or workaround exists; the source notes the vendor did not respond (https://nvd.nist.gov/vuln/detail/CVE-2026-112098).","how_to_check":"- Check the installed DeepPavlov version with `pip show deeppavlov` and treat anything at or below `1.7.0` as affected.\n- Look for code that loads DeepPavlov configs from untrusted or user-supplied input.\n- unknown whether the sources give a specific trigger path beyond the resolve function.","needs_analyst":true,"not_affected_if":["fixed-internal-configs"],"who_is_affected":"Teams running DeepPavlov 1.7.0 or earlier are exposed, most likely where the framework parses configuration or reference strings that come from outside the team. Systems that use DeepPavlov only with fixed, internally written configs are less exposed, but the sources do not confirm which input reaches the vulnerable function.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":3336,"output_tokens":696,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112098':12A,15A '-2026':11A,14A '1.7.0':53B,81C 'ai':17B,32B 'ai-tool':16B 'allow':6A 'attack':56B,104C,122C 'code':8A,36B,65B,101C 'compon':93C 'config':2A,41B,94C 'configur':61B 'convers':31B 'craft':60B 'cve':10A,13A 'deeppavlov':1A,19B,24B,78C 'deeppavlov/core/common/params.py':48B,90C 'discov':76C 'earli':130C 'execut':66B 'exploit':110C 'file':89C 'flaw':5A,38B,73C 'framework':33B 'function':46B,85C 'get':64B 'host':23B,69B 'impact':82C 'inform':126C 'inject':9A,37B,102C 'input':62B 'issu':133C 'launch':107C 'manipul':98C 'may':63B,118C 'nlp':29B 'open':27B 'open-sourc':26B 'problem':129C 'project':124C 'public':116C 'python':20B 'refer':3A,42B,95C 'releas':113C 'remot':7A,55B,108C 'report':134C 'resolv':4A,43B,45B,86C,96C 'respond':138C 'result':99C 'run':70B 'secur':72C 'self':22B 'self-host':21B 'sourc':28B 'suppli':59B 'tool':18B 'use':120C 'version':50B 'yet':139C","nicknames":[],"mitigations":[],"who_affected":"Teams running DeepPavlov 1.7.0 or earlier are exposed, most likely where the framework parses configuration or reference strings that come from outside the team. Systems that use DeepPavlov only with fixed, internally written configs are less exposed, but the sources do not confirm which input reaches the vulnerable function.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T09:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112098","severity":null,"published_at":"2026-10-19T09:17:07+00:00","modified_at":"2026-10-19T18:17:02+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}