CVE-2026-112098

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-112098

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112098.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-112098

Published

2026-10-19T09:00:19Z

Modified

2026-10-21T02:56:55Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

DeepPavlov Config Reference Resolver params.py resolve code injection

Details

A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-74",
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112098.json"
}

References

Affected packages

Git / github.com/deeppavlov/deeppavlov

Affected ranges

Type

GIT

Repo

https://github.com/deeppavlov/deeppavlov

Events

Introduced

1a594494bfc597fcbee2bb40d27a6b78d9cb9826

Last Affected

aff27489a3c87644eeb8f6009e4a824e83c66c05

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.0"
                },
                {
                    "last_affected":  "1.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.1"
                },
                {
                    "last_affected":  "1.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.2"
                },
                {
                    "last_affected":  "1.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.3"
                },
                {
                    "last_affected":  "1.3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.4"
                },
                {
                    "last_affected":  "1.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.5"
                },
                {
                    "last_affected":  "1.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.6"
                },
                {
                    "last_affected":  "1.6"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.7.0"
                },
                {
                    "last_affected":  "1.7.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        }
    ]
}

Affected versions

1.*

1.0

1.0.0

1.0.1

1.0.2

1.1

1.1.0

1.1.1

1.2

1.2.0

1.3

1.3.0

1.4

1.4.0

1.5

1.5.0

1.6

1.6.0

1.7.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112098.json"