PT-2026-117303

CVE-2026-112100

Published

2026-10-19

Updated

2026-10-19

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DeepPavlov versions prior to 1.7.1

Description Remote code injection is possible through the manipulation of the preprocessor argument within the MultiTaskPipelinePreprocessor. init () function located in the deeppavlov/models/preprocessors/multitask preprocessor.py file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the MultiTaskPipelinePreprocessor. init () function.

Exploitability

Exploit

Impacts

Researchers

Dem0000000

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers

CVE-2026-112100