The vulnerability is a code injection flaw in DeepPavlov’s MultiTaskPipelinePreprocessor.__init__ method. By manipulating the preprocessor argument, an attacker can cause malicious code to be executed with the process’s privileges. This can lead to complete compromise of the system that hosts the DeepPavlov instance.

DeepPavlov libraries up to and including version 1.7.0 are affected. The issue exists in the deeppavlov/models/preprocessors/multitask_preprocessor.py file and any deployment that accepts custom preprocessor parameters from an untrusted source.

The CVSS score of 5.1 classifies the flaw as moderate severity, but the remote nature of the attack and the absence of remediation from the vendor increase the real‑world risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending crafted input that triggers code execution, and no additional prerequisites beyond remote access to the API endpoint are mentioned in the description.