Low
DeepPavlov Config Reference Resolver params.py resolve code injection
Type: advisorySources: OSV
A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-112098
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 17:56 UTC · Revision 1
Source evidence
DeepPavlov Config Reference Resolver params.py resolve code injection
core-osv · Original sourcePublished 19 Oct 2026, 09:00 UTC
A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
osv:CVE-2026-112098
Complete source record
{
"id": "32a92e07b4b35f1a481cf6715b9bbcfb43627f9a2df818f2a62e4fe06cf4c6d3",
"url": "https://osv.dev/vulnerability/CVE-2026-112098",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DeepPavlov Config Reference Resolver params.py resolve code injection",
"summary": "A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.",
"evidence": "osv:CVE-2026-112098",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2026-112098",
"aliases": [
"CVE-2026-112098"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/deeppavlov/deeppavlov",
"type": "GIT",
"events": [
{
"introduced": "1a594494bfc597fcbee2bb40d27a6b78d9cb9826"
},
{
"last_affected": "aff27489a3c87644eeb8f6009e4a824e83c66c05"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "1.0"
},
{
"last_affected": "1.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.1"
},
{
"last_affected": "1.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.2"
},
{
"last_affected": "1.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.3"
},
{
"last_affected": "1.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.4"
},
{
"last_affected": "1.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.5"
},
{
"last_affected": "1.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.6"
},
{
"last_affected": "1.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "1.7.0"
},
{
"last_affected": "1.7.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.7.0"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"1.0",
"1.1",
"1.2",
"1.3",
"1.4",
"1.5",
"1.6",
"1.7.0",
"1.6.0",
"1.5.0",
"1.4.0",
"1.3.0",
"1.2.0",
"1.1.1",
"1.1.0",
"1.0.2",
"1.0.1",
"1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112098.json"
}
}
],
"modified": "2026-10-28T02:30:51.342734299Z",
"provider": "osv",
"references": [
"https://github.com/deeppavlov/DeepPavlov/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112098.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-112098",
"https://vuldb.com/cve/CVE-2026-112098",
"https://vuldb.com/submit/1012810",
"https://vuldb.com/vuln/421933",
"https://github.com/deeppavlov/DeepPavlov/issues/1713",
"https://vuldb.com/vuln/421933/cti",
"https://github.com/user-attachments/files/33004686/poc.zip"
],
"provider_metadata": {
"cwe_ids": [
"CWE-74",
"CWE-94"
],
"cna_assigner": "VulDB",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112098.json"
}
},
"related_cves": [
{
"value": "CVE-2026-112098",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 520033,
"published_at": "2026-10-19T09:00:19.171+00:00"
}