# CVE-2026-112098: DeepPavlov code injection in config reference resolver

Source: https://junglewise.ai/threats/cve-2026-112098-a-security-flaw-has-been-discovered-in-deeppavlov-up-to-1-7-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-112098 · Severity: medium · CVSS 6.3 · Published 2026-10-19

DeepPavlov is an open-source library for building dialog systems and chatbots. A flaw in its configuration parser allows attackers to inject arbitrary Python code through specially crafted model configuration files, which execute with full privileges when the model is loaded or trained. Since configuration files are commonly shared across repositories and tutorials, a malicious config can silently compromise systems running legitimate-looking DeepPavlov commands.

Technologies: [DeepPavlov](https://junglewise.ai/threats/technologies/deeppavlov). Vendors: [DeepPavlov](https://junglewise.ai/threats/vendors/deeppavlov).

## Quick answers

**Is CVE-2026-112098 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112098 being exploited in the wild.

**How severe is CVE-2026-112098?** Medium severity, with a CVSS score of 6.3, published 19 October 2026.

**Which products and versions are affected?** DeepPavlov up to 1.7.0.

**Is there a fix for CVE-2026-112098?** No fixed version is recorded yet. Avoid loading DeepPavlov model configurations from untrusted or unverified sources; review any shared configs before use to ensure they do not contain '#ref' expressions in ordinary parameters.</anigation>
</invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-112098 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-112098?** Check whether you run DeepPavlov at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Avoid loading DeepPavlov model configurations from untrusted or unverified sources; review any shared configs before use to ensure they do not contain '#ref' expressions in ordinary parameters.</anigation>
</invoke>

## Technical details

The config reference resolver in deeppavlov/core/common/params.py uses unrestricted Python eval() to process config values prefixed with '#', passing dotted attribute paths directly to eval() instead of safely traversing them with getattr(). An attacker can craft a config parameter containing a '#ref' expression that escapes to __builtins__.__import__ and executes arbitrary code at model-build time. The vulnerability requires only that a normal component exists in the config; no custom class or pickle payload is needed.

## Affected products

- DeepPavlov DeepPavlov up to 1.7.0

## Timeline

- 2026-10-19: disclosed
- 2026-10-03: exploited: Exploit proof-of-concept publicly released; issue #1713 opened but not yet responded to by maintainers

## References

- [https://github.com/deeppavlov/DeepPavlov/](https://github.com/deeppavlov/DeepPavlov/)
- [https://github.com/deeppavlov/DeepPavlov/issues/1713](https://github.com/deeppavlov/DeepPavlov/issues/1713)

## Related threats

- [DeepPavlov code injection in MultiTaskPipelinePreprocessor](https://junglewise.ai/threats/cve-2026-112100-a-vulnerability-was-determined-in-deeppavlov-up-to-1-7-0-this)
- [DeepPavlov path traversal in Model Download Handler](https://junglewise.ai/threats/cve-2026-109155-a-flaw-has-been-found-in-deeppavlov-up-to-1-7-0-this-impacts-the)