CVE-2026-112100

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-112100

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112100.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-112100

Published

2026-10-19T09:15:19Z

Modified

2026-10-24T02:49:26Z

Severity

2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

DeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.__init__ code injection

Details

A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.init of the file deeppavlov/models/preprocessors/multitask_preprocessor.py. This manipulation of the argument preprocessor causes code injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-74",
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112100.json"
}

References

Affected packages

Git / github.com/deeppavlov/deeppavlov

Affected ranges

Type

GIT

Repo

https://github.com/deeppavlov/deeppavlov

Events

Introduced

1a594494bfc597fcbee2bb40d27a6b78d9cb9826

Last Affected

aff27489a3c87644eeb8f6009e4a824e83c66c05

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.0"
                },
                {
                    "last_affected":  "1.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.1"
                },
                {
                    "last_affected":  "1.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.2"
                },
                {
                    "last_affected":  "1.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.3"
                },
                {
                    "last_affected":  "1.3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.4"
                },
                {
                    "last_affected":  "1.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.5"
                },
                {
                    "last_affected":  "1.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.6"
                },
                {
                    "last_affected":  "1.6"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.7.0"
                },
                {
                    "last_affected":  "1.7.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.7.0"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

1.*

1.0

1.0.0

1.0.1

1.0.2

1.1

1.1.0

1.1.1

1.2

1.2.0

1.3

1.3.0

1.4

1.4.0

1.5

1.5.0

1.6

1.6.0

1.7.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112100.json"