---
id: "CVE-2026-112098"
kind: "vulnerability"
aliases: ["CVE-2026-112098"]
title: "DeepPavlov: config reference resolver flaw allows remote code injection"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "deeppavlov", "python", "self-hosted"]
not_affected_if: ["fixed-internal-configs"]
published_at: "2026-10-19T09:17:07+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:23:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112098", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# DeepPavlov: config reference resolver flaw allows remote code injection

DeepPavlov, an open-source NLP and conversational AI framework, has a code injection flaw in its config reference resolver (the resolve function in deeppavlov/core/common/params.py) in versions up to 1.7.0. A remote attacker who can supply crafted configuration input may get code executed on the host running it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed DeepPavlov version with `pip show deeppavlov` and treat anything at or below `1.7.0` as affected.
- Look for code that loads DeepPavlov configs from untrusted or user-supplied input.
- unknown whether the sources give a specific trigger path beyond the resolve function.

## Fix

- unknown: the sources say the project has not responded and no fixed version is listed.
- Until a fix is released, avoid loading configuration from untrusted input and restrict network access to services running DeepPavlov.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112098

## From the sources

A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_