CVE-2026-126994
braindecode Model Config Deserialization util.py resolve_type_kwargs externally-controlled input to select classes or code
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability has been found in braindecode up to 1.8.1. Affected is the function resolve_type_kwargs of the file braindecode/models/util.py of the component Model Config Deserialization. Such manipulation of the argument Activation leads to use of externally-controlled input to select classes or code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. The affected component should be upgraded.
| CWE | CWE-470 |
| Vendor | n/a |
| Product | braindecode |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a braindecode
Be the first to know when new medium vulnerabilities affecting n/a braindecode are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / braindecode
1.8.0 1.8.1
References
vuldb.com: https://vuldb.com/vuln/436293 vuldb.com: https://vuldb.com/vuln/436293/cti vuldb.com: https://vuldb.com/cve/CVE-2026-126994 vuldb.com: https://vuldb.com/submit/1040635 github.com: https://github.com/braindecode/braindecode/issues/1441 github.com: https://github.com/braindecode/braindecode/pull/1494 github.com: https://github.com/user-attachments/files/33599402/poc.zip github.com: https://github.com/braindecode/braindecode/commit/05b764d93b9a50400f523206fbe03d73d0cf5edb github.com: https://github.com/braindecode/braindecode/releases/tag/v2.0.0 github.com: https://github.com/braindecode/braindecode/
Credits
🔍 Dem00000 (VulDB User)