{"data":{"id":"8d8c4714-86e9-4ddf-8816-6773fe00da00","title":"CVE-2026-126994: A vulnerability has been found in braindecode up to 1.8.1. Affected is the function resolve_type_kwargs of the file…","summary":"CVE-2026-126994 affects braindecode up to 1.8.1, specifically the resolve_type_kwargs function in braindecode/models/util.py within the Model Config Deserialization component. Manipulating the Activation argument leads to use of externally controlled input to select classes or code, and the attack can be launched remotely. A public exploit exists and may be used.","solution":"Upgrading to version 2.0.0 addresses this issue. The patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb, and the affected component should be upgraded.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-126994","publishedAt":"2026-11-12T13:17:15.690Z","cveId":"CVE-2026-126994","cweIds":["CWE-470"],"cvssScore":"6.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["braindecode"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"braindecode model config deserialization flaw via activation argument","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-11-12T15:03:07.711Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-12T15:03:10.496Z","patchAvailable":null,"disclosureDate":"2026-11-12T13:17:15.690Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}