Live › vulnerability › CVE-2026-112100
Go to dashboardDeepPavlov up to 1.7.0 passes the preprocessor argument of MultiTaskPipelinePreprocessor.__init__ into code without proper checks. A remote attacker who controls that argument can inject code that runs on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use DeepPavlov 1.7.0 or lower and build the MultiTaskPipelinePreprocessor from values an outside party can influence are exposed. Systems that only load fixed, developer-written pipeline configs are less likely to be reachable; the sources do not say how common that setup is.
No product ranges from the sources yet.
preprocessor argument for MultiTaskPipelinePreprocessor and whether any part of it comes from user input or external config.preprocessor argument out of anything a user or remote caller can set.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.init of the file deeppavlov/models/preprocessors/multitask_preprocessor.py. This manipulation of the argument preprocessor causes code injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112100")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.