CVE-2026-112098: Code Injection in DeepPavlov

This vulnerability affects the resolve function in the Config Reference Resolver component of DeepPavlov up to version 1.7.0. An attacker can remotely manipulate this function to perform code injection, potentially executing arbitrary code. The issue was responsibly disclosed early via an issue report, but no official response or patch has been provided by the vendor. Public exploit code has been released, increasing the risk of exploitation.

Successful exploitation allows remote attackers to inject and execute arbitrary code within the DeepPavlov environment. This can lead to unauthorized actions and compromise of the affected system. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and partial impacts on confidentiality, integrity, and availability.

No official fix or patch is currently available from the vendor. Users should monitor the DeepPavlov project for updates and consider applying temporary mitigations such as restricting network access to the vulnerable component or disabling the affected functionality if feasible. Due to the availability of public exploit code, caution and heightened monitoring are advised until a patch is released.