{"id":"CVE-2026-126994","kind":"vulnerability","aliases":["CVE-2026-126994"],"related":[],"title":"braindecode: model config deserialization lets remote input select code to run","description":"A vulnerability has been found in braindecode up to 1.8.1. Affected is the function resolve_type_kwargs of the file braindecode/models/util.py of the component Model Config Deserialization. Such manipulation of the argument Activation leads to use of externally-controlled input to select classes or code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. The affected component should be upgraded.","summary":"braindecode, a Python library for EEG deep learning models, passes externally controlled values from a model config (the Activation argument) into code that selects classes, so a crafted config can make the library run attacker-chosen code. The sources say the exploit is public and can be launched remotely.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"braindecode","fixed":[],"affected":"","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["braindecode","machine-learning","package","python"],"not_affected_if":["hard-coded-configs","no-untrusted-model-config"],"how_to_check":"- Check the installed version with `pip show braindecode`; versions up to and including `1.8.1` are listed as affected.\n- Search your code and configs for places that load model configs from untrusted sources into `resolve_type_kwargs` in `braindecode/models/util.py`.","fix":"- braindecode: upgrade to `2.0.0` (the sources name a patch commit, 05b764d93b9a50400f523206fbe03d73d0cf5edb).","status":"open","published_at":"2026-11-12T13:17:15+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","triaged_at":"2026-11-12T13:38:51+00:00","updated_at":"2026-11-12T13:38:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T13:38:51Z","model":"claude-haiku-5-5","output":{"fix":"- braindecode: upgrade to `2.0.0` (the sources name a patch commit, 05b764d93b9a50400f523206fbe03d73d0cf5edb).","reach":"network","title":"braindecode: model config deserialization lets remote input select code to run","impact":"high","summary":"braindecode, a Python library for EEG deep learning models, passes externally controlled values from a model config (the Activation argument) into code that selects classes, so a crafted config can make the library run attacker-chosen code. The sources say the exploit is public and can be launched remotely.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","braindecode","machine-learning"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker-chosen code runs in the process that loads the config","analyst_note":"Confirm whether the vulnerable path is reachable from untrusted input and read the linked patch and release notes at github.com to verify the 2.0.0 fix.","how_to_check":"- Check the installed version with `pip show braindecode`; versions up to and including `1.8.1` are listed as affected.\n- Search your code and configs for places that load model configs from untrusted sources into `resolve_type_kwargs` in `braindecode/models/util.py`.","plain_action":"","product_name":"braindecode","needs_analyst":true,"not_affected_if":["hard-coded-configs","no-untrusted-model-config"],"who_is_affected":"Teams that load braindecode model configurations from sources they do not fully control, such as user uploads, shared config files or external APIs, are exposed. Projects that only build models from their own hard-coded configs are less exposed, but the sources do not say that explicitly.","user_interaction":"unknown","product_ecosystem":"pypi","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000785,"input_tokens":4655,"output_tokens":638,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126994':14A,17A '-2026':13A,16A '05b764d93b9a50400f523206fbe03d73d0cf5edb':155C '1.8.1':84C '2.0.0':142C 'abl':144C 'activ':43B,107C 'address':146C 'affect':85C,157C 'argument':44B,106C 'attack':60B,122C 'attacker-chosen':59B 'braindecod':1A,19B,25B,81C 'braindecode':18A 'braindecode/models/util.py':95C 'chosen':61B 'class':49B,118C 'code':9A,46B,62B,120C 'compon':98C,158C 'config':3A,41B,53B,100C 'control':36B,114C 'craft':52B 'cve':12A,15A 'deep':31B 'deseri':4A,101C 'disclos':131C 'eeg':30B 'exploit':67B,128C 'extern':35B,113C 'externally-control':112C 'file':94C 'found':79C 'function':88C 'input':7A,115C 'issu':148C 'kwarg':91C 'launch':73B,125C 'lead':108C 'learn':22B,32B 'let':5A 'librari':28B,57B 'machin':21B 'machine-learn':20B 'make':55B 'manipul':103C 'may':136C 'model':2A,33B,40B,99C 'name':150C 'packag':23B 'pass':34B 'patch':153C 'public':69B,134C 'python':24B,27B 'remot':6A,74B,126C 'resolv':89C 'run':11A,58B 'say':65B 'select':8A,48B,117C 'sourc':64B 'type':90C 'upgrad':139C,161C 'use':110C,138C 'valu':37B 'version':141C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Teams that load braindecode model configurations from sources they do not fully control, such as user uploads, shared config files or external APIs, are exposed. Projects that only build models from their own hard-coded configs are less exposed, but the sources do not say that explicitly.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["braindecode"],"ptokens":["braindecode"],"labels":["braindecode","high","machinelearning","package","pypi","python"],"campaign_type":null,"search_a":"'-126994':14A,17A '-2026':13A,16A 'braindecod':1A 'braindecode':18A 'code':9A 'config':3A 'cve':12A,15A 'deseri':4A 'input':7A 'let':5A 'model':2A 'remot':6A 'run':11A 'select':8A","search_b":"'activ':43B 'argument':44B 'attack':60B 'attacker-chosen':59B 'braindecod':19B,25B 'chosen':61B 'class':49B 'code':46B,62B 'config':41B,53B 'control':36B 'craft':52B 'deep':31B 'eeg':30B 'exploit':67B 'extern':35B 'launch':73B 'learn':22B,32B 'librari':28B,57B 'machin':21B 'machine-learn':20B 'make':55B 'model':33B,40B 'packag':23B 'pass':34B 'public':69B 'python':24B,27B 'remot':74B 'run':58B 'say':65B 'select':48B 'sourc':64B 'valu':37B","search_c":"'05b764d93b9a50400f523206fbe03d73d0cf5edb':155C '1.8.1':84C '2.0.0':142C 'abl':144C 'activ':107C 'address':146C 'affect':85C,157C 'argument':106C 'attack':122C 'braindecod':81C 'braindecode/models/util.py':95C 'class':118C 'code':120C 'compon':98C,158C 'config':100C 'control':114C 'deseri':101C 'disclos':131C 'exploit':128C 'extern':113C 'externally-control':112C 'file':94C 'found':79C 'function':88C 'input':115C 'issu':148C 'kwarg':91C 'launch':125C 'lead':108C 'manipul':103C 'may':136C 'model':99C 'name':150C 'patch':153C 'public':134C 'remot':126C 'resolv':89C 'select':117C 'type':90C 'upgrad':139C,161C 'use':110C,138C 'version':141C 'vulner':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T13:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126994","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126994","severity":null,"published_at":"2026-11-12T13:17:15+00:00","modified_at":"2026-11-12T13:17:15+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","fetched_at":"2026-11-12T13:38:24+00:00","note":null}],"documents":[{"id":135103,"url":"https://github.com/braindecode/braindecode/commit/05b764d93b9a50400f523206fbe03d73d0cf5edb","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":135104,"url":"https://github.com/braindecode/braindecode/releases/tag/v2.0.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}