A vulnerability has been identified in AllenAI’s AllenNLP library, specifically within the Registrable.resolve_class_name method. By manipulating the Type argument, an attacker can cause the code to execute arbitrary instructions, effectively leading to remote code execution. This weakness is classified as code injection, as indicated by the CWE identifiers. The vulnerability compromises confidentiality, integrity, and availability by allowing an attacker to run arbitrary code on the affected system.

The flaw applies to AllenAI AllenNLP releases up to and including version 2.10.1. No supported releases are listed as affected; the issue is confined to older, no longer maintained versions that are no longer supported by the maintainer. The configuration machinery in the common/registrable.py component is the exact locus.

The CVSS score of 5.3 places the vulnerability in the moderate risk range. The EPSS score is not available, but the disclosure states that the exploit has already been made public, indicating that attackers can potentially use it out of the box. KEV does not list the vulnerability, and the vendor has not applied a fix. Active exploitation is possible remotely; attackers need only craft a request that alters the Type argument to trigger code injection.