The vulnerability lies in the resolve function of DeepPavlov's Config Reference Resolver, allowing an attacker to craft input that injects and executes arbitrary code. This occurs when parameters are processed by the function, and the attack can be launched remotely. The exploitation of this weakness can compromise the confidentiality, integrity, and availability of the affected system, potentially granting full remote code execution.

DeepPavlov libraries up to version 1.7.0 are affected. The issue is present in the deeppavlov/core/common/params.py component across all installations using these versions. No other vendor or product lines are listed as impacted.

The CVSS score is 5.3, indicating moderate severity, and the public exploit demonstrates the vulnerability is actionable. The EPSS score is unavailable, while the vulnerability is not yet listed in CISA KEV. The likely attack vector is remote code execution via crafted input to the resolve function, requiring network access to the service exposing the resolver.