---
id: CVE-2026-25632
aliases:
  - GHSA-74vm-8frp-7w68
  - PYSEC-2026-330
title: EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)
summary: EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
vendor: epyt-flow
product: epyt-flow
ecosystem: pip
affected:
  - epyt-flow < 0.16.1
patched:
  - epyt-flow 0.16.1
published: '2026-02-04'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T16:30:07.245251191Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-74vm-8frp-7w68'
references:
  - url: >-
      https://github.com/WaterFutures/EPyT-Flow/security/advisories/GHSA-74vm-8frp-7w68
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-25632'
  - url: >-
      https://github.com/WaterFutures/EPyT-Flow/commit/3fff9151494c7dbc72073830b734f0a7e550e385
  - url: 'https://github.com/WaterFutures/EPyT-Flow'
  - url: 'https://github.com/WaterFutures/EPyT-Flow/releases/tag/v0.16.1'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/epyt-flow/PYSEC-2026-330.yaml
  - url: 'https://pypi.org/project/epyt-flow'
  - url: 'https://github.com/advisories/GHSA-74vm-8frp-7w68'
tags:
  - osv
  - pip
  - exploit-available
  - ghsa
epss: 0.00807
epssPercentile: 0.56613
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/lazarus0x1337/CVE-2026-25632'
  checkedAt: '2026-10-27T16:44:42.935Z'
exploitAvailable: true
cwe:
  - CWE-502
ingestedAt: '2026-10-27T16:32:34.353Z'
---

## Overview

### Impact
EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a __type__ field. When __type__ is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files.

### Patches
EPyT-Flow  has been patched in 0.16.1 -- affects all versions <= 0.16.0

### Workarounds
Do not load any JSON from untrusted sources and do not expose the REST API.

### Credits
EPyT-Flow  thanks Jarrett Chan (@syphonetic) for detecting and reporting the bug.

## Affected packages

- `epyt-flow < 0.16.1`

## Remediation

Upgrade to a patched release:

- `epyt-flow 0.16.1`