{"id":"CVE-2026-25632","aliases":["GHSA-74vm-8frp-7w68","PYSEC-2026-330"],"title":"EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)","summary":"EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","vendor":"epyt-flow","product":"epyt-flow","ecosystem":"pip","affected":["epyt-flow < 0.16.1"],"patched":["epyt-flow 0.16.1"],"published":"2026-02-04","updated":"2026-10-27","sourceUpdated":"2026-10-27T16:30:07.245251191Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-74vm-8frp-7w68","references":[{"url":"https://github.com/WaterFutures/EPyT-Flow/security/advisories/GHSA-74vm-8frp-7w68"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25632"},{"url":"https://github.com/WaterFutures/EPyT-Flow/commit/3fff9151494c7dbc72073830b734f0a7e550e385"},{"url":"https://github.com/WaterFutures/EPyT-Flow"},{"url":"https://github.com/WaterFutures/EPyT-Flow/releases/tag/v0.16.1"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/epyt-flow/PYSEC-2026-330.yaml"},{"url":"https://pypi.org/project/epyt-flow"},{"url":"https://github.com/advisories/GHSA-74vm-8frp-7w68"}],"tags":["osv","pip","exploit-available","ghsa"],"epss":0.00807,"epssPercentile":0.56613,"exploits":{"github":1,"githubRepos":["https://github.com/lazarus0x1337/CVE-2026-25632"],"checkedAt":"2026-10-27T16:44:42.935Z"},"exploitAvailable":true,"cwe":["CWE-502"],"ingestedAt":"2026-10-27T16:32:34.353Z","slug":"CVE-2026-25632","body":"## Overview\n\n### Impact\nEPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a __type__ field. When __type__ is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files.\n\n### Patches\nEPyT-Flow  has been patched in 0.16.1 -- affects all versions <= 0.16.0\n\n### Workarounds\nDo not load any JSON from untrusted sources and do not expose the REST API.\n\n### Credits\nEPyT-Flow  thanks Jarrett Chan (@syphonetic) for detecting and reporting the bug.\n\n## Affected packages\n\n- `epyt-flow < 0.16.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `epyt-flow 0.16.1`","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":55,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[]}