CVE-2026-116275

AllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection

View on CVE.org
Published Oct 26, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve_class_name of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Analysis

AI-generated

Technical impact

A vulnerability has been identified in AllenAI’s AllenNLP library, specifically within the Registrable.resolve_class_name method. By manipulating the Type argument, an attacker can cause the code to execute arbitrary instructions, effectively leading to remote code execution. This weakness is classified as code injection, as indicated by the CWE identifiers. The vulnerability compromises confidentiality, integrity, and availability by allowing an attacker to run arbitrary code on the affected system.

Affected Systems

The flaw applies to AllenAI AllenNLP releases up to and including version 2.10.1. No supported releases are listed as affected; the issue is confined to older, no longer maintained versions that are no longer supported by the maintainer. The configuration machinery in the common/registrable.py component is the exact locus.

Risk and Exploitability

The CVSS score of 5.3 places the vulnerability in the moderate risk range. The EPSS score is not available, but the disclosure states that the exploit has already been made public, indicating that attackers can potentially use it out of the box. KEV does not list the vulnerability, and the vendor has not applied a fix. Active exploitation is possible remotely; attackers need only craft a request that alters the Type argument to trigger code injection.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade AllenNLP to a supported, patched release newer than 2.10.1.
  • If upgrading is not feasible, harden the input handling by validating or sanitizing the Type argument to prevent arbitrary code resolution.
  • Limit exposure by restricting network access to the parts of the application that use Registrable’s resolve_class_name and monitor for abnormal execution patterns or injection attempts.

Generated by OpenCVE AI on October 26, 2026 at 16:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve_class_name of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Title AllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection
First Time appeared Allenai
Allenai allennlp
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:allenai:allennlp:*:*:*:*:*:*:*:*
Vendors & Products Allenai
Allenai allennlp
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 26, 2026, 4:16 PM
Reserved
Oct 25, 2026, 6:14 PM

View source JSON

Updated
Oct 26, 2026, 4:08 PM

JSON

Status
Deferred
Published
Oct 26, 2026, 2:16 PM
Modified
Oct 26, 2026, 6:41 PM

View source JSON

No data.

Updated
Oct 26, 2026, 6:50 PM

JSON