CVE-2026-112098
DeepPavlov Config Reference Resolver params.py resolve code injection
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-94 CWE-74 |
| Vendor | n/a |
| Product | deeppavlov |
| Published | Oct 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a deeppavlov
Be the first to know when new medium vulnerabilities affecting n/a deeppavlov are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / DeepPavlov
1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7.0
References
vuldb.com: https://vuldb.com/vuln/421933 vuldb.com: https://vuldb.com/vuln/421933/cti vuldb.com: https://vuldb.com/cve/CVE-2026-112098 vuldb.com: https://vuldb.com/submit/1012810 github.com: https://github.com/deeppavlov/DeepPavlov/issues/1713 github.com: https://github.com/user-attachments/files/33004686/poc.zip github.com: https://github.com/deeppavlov/DeepPavlov/
Credits
🔍 Dem0000000 (VulDB User) VulDB CNA Team