6.3
MediumCVSS 3.1 · from VulDB
CVE-2026-116275
AllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection
AllenNLP · Code injection · CWE-94AffectedAllenNLP
FixNo fix listed yet.
PublishedOct 26, 12:30 · VulDB
ScoredOct 26 · 6.3 · VulDB
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC
What we know
No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolve_class_name of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
From VulDB
Affected and fixed versions
ProductAffectedFixed inAllenNLP2.10.0–AllenNLP2.10.1–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known