Allennlp
Monthly
Code injection in AllenAI AllenNLP through 2.10.1 allows an attacker who controls the 'type' value in a configuration to drive unsafe reflective class instantiation through Registrable.resolve_class_name, potentially achieving code execution inside any host application that loads that configuration. Exposure is limited to deployments that pass untrusted FromParams-style configuration into the Registrable machinery and requires the victim to process the malicious config, so the library handling only trusted, local configurations is not affected. A public PoC reference exists (it is not verified as working exploit code), there is no CISA KEV entry, and the maintainer did not respond - the project is end-of-life, so no vendor fix is expected and the current priority is monitoring.
Code injection in AllenAI AllenNLP through 2.10.1 allows an attacker who controls the 'type' value in a configuration to drive unsafe reflective class instantiation through Registrable.resolve_class_name, potentially achieving code execution inside any host application that loads that configuration. Exposure is limited to deployments that pass untrusted FromParams-style configuration into the Registrable machinery and requires the victim to process the malicious config, so the library handling only trusted, local configurations is not affected. A public PoC reference exists (it is not verified as working exploit code), there is no CISA KEV entry, and the maintainer did not respond - the project is end-of-life, so no vendor fix is expected and the current priority is monitoring.