DeepPavlov CVE-2026-112100

Exploitation requires the attacker to control the preprocessor argument passed to MultiTaskPipelinePreprocessor.__init__ - in practice, the ability to supply or alter the DeepPavlov pipeline/model configuration that a deployment loads. The CVSS vector requires privileges (PR:L) and passive user interaction (UI:P), meaning a user or service must load and run the malicious configuration; it is therefore not a drive-by unauthenticated remote exploit. Affected versions are DeepPavlov up to and including 1.7.0, and no patched release is available. Limiting factors: the vulnerable constructor must be reachable with untrusted configuration input, authentication/low privilege is needed, and the attacker cannot trigger it without the victim invoking the affected pipeline.

Available signals point to a modest, situational risk rather than an urgent priority. The only CVSS data provided is a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P, base 5.1/Medium), which reports LOW confidentiality, integrity, and availability impact and requires both privileges (PR:L) and user interaction (UI:P) - this materially caps the score. That rated-low impact CONFLICTS with the CWE-94 classification and the 'RCE'/'Code Injection' tagging, since successful code injection normally yields full arbitrary-code execution (High impact); this discrepancy should be verified, as the true impact is likely higher than the vector states. The E:P value and the 'POC publicly available' flag confirm proof-of-concept exploit code exists, but there is NO active-exploitation evidence: not listed in CISA KEV, and no EPSS score was supplied, so exploitation probability cannot be quantified from the input. The record is sourced solely from VulDB, the vendor (DeepPavlov) was notified via GitHub issue #1714 but has not responded and no patch exists, and the 'remote' claim (AV:N) sits uneasily with a flaw triggered by manipulating an __init__ constructor argument, which in practice requires control over the pipeline configuration supplied to the library. Net: publicly available POC against an unpatched niche ML library, but gated by privileges, user interaction, and config control - real but low-to-medium priority absent exposure of the affected component to untrusted input.

An attacker who can influence the pipeline/model configuration consumed by a DeepPavlov (≤1.7.0) deployment supplies a crafted value for the preprocessor argument processed by MultiTaskPipelinePreprocessor.__init__, which is interpreted as code (CWE-94). When a user or service loads and runs that configuration (UI:P), the injected payload executes in the host Python process. A proof-of-concept is publicly available (poc.zip linked from the GitHub issue), lowering the effort to reproduce.