---
id: "CVE-2026-126994"
page: "https://infrastack.ai/live/CVE-2026-126994"
kind: "vulnerability"
aliases: ["CVE-2026-126994"]
title: "braindecode: model config deserialization lets remote input select code to run"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "braindecode", "fixed": [], "affected": "", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["braindecode", "machine-learning", "package", "python"]
not_affected_if: ["hard-coded-configs", "no-untrusted-model-config"]
published_at: "2026-11-12T13:17:15+00:00"
first_seen_at: "2026-11-12T13:38:24+00:00"
updated_at: "2026-11-12T13:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126994", "first_seen_at": "2026-11-12T13:38:24+00:00"}]
exploit_sources: []
---

# braindecode: model config deserialization lets remote input select code to run

Link for people: https://infrastack.ai/live/CVE-2026-126994 (this .md is for agents)

braindecode, a Python library for EEG deep learning models, passes externally controlled values from a model config (the Activation argument) into code that selects classes, so a crafted config can make the library run attacker-chosen code. The sources say the exploit is public and can be launched remotely.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:braindecode affected range not listed fixed no fixed version listed

## How to check

- Check the installed version with `pip show braindecode`; versions up to and including `1.8.1` are listed as affected.
- Search your code and configs for places that load model configs from untrusted sources into `resolve_type_kwargs` in `braindecode/models/util.py`.

## Fix

- braindecode: upgrade to `2.0.0` (the sources name a patch commit, 05b764d93b9a50400f523206fbe03d73d0cf5edb).

## Timeline

- 2026-11-12T13:38:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126994

## Documents

- [fix] Patch: github.com https://github.com/braindecode/braindecode/commit/05b764d93b9a50400f523206fbe03d73d0cf5edb
- [fix] Release notes: github.com https://github.com/braindecode/braindecode/releases/tag/v2.0.0

## From the sources

A vulnerability has been found in braindecode up to 1.8.1. Affected is the function resolve_type_kwargs of the file braindecode/models/util.py of the component Model Config Deserialization. Such manipulation of the argument Activation leads to use of externally-controlled input to select classes or code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. The affected component should be upgraded.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_