CVE-2026-112098

Name of the Vulnerable Software and Affected Versions DeepPavlov versions prior to 1.7.1

Description A flaw in the Config Reference Resolver component allows for remote code injection. The issue resides in the resolve() function within the deeppavlov/core/common/params.py file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the resolve() function in the deeppavlov/core/common/params.py file to minimize the risk of exploitation.