CVE-2026-126994
braindecode Model Config Deserialization util.py resolve_type_kwargs externally-controlled input to select classes or code
Description
A vulnerability has been found in braindecode up to 1.8.1. Affected is the function resolve_type_kwargs of the file braindecode/models/util.py of the component Model Config Deserialization. Such manipulation of the argument Activation leads to use of externally-controlled input to select classes or code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. The affected component should be upgraded.
INFO
Published Date :
Nov. 12, 2026, 12:30 p.m.
Last Modified :
Nov. 12, 2026, 12:30 p.m.
Remotely Exploit :
No
Source :
VulDB
Solution
- Upgrade braindecode to version 2.0.0.
- Apply the patch 05b764d93b9a50400f523206fbe03d73d0cf5edb.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-126994 vulnerability anywhere in the article.