CVE-2025-61774

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-61774
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-61774.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-61774
Aliases
  • GHSA-xr7f-qcjc-63rv
Downstream
Published
2025-10-06T22:14:38.713Z
Modified
2026-04-10T05:33:51.992115Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
PyVista has Dependency Confusion Vulnerability in that leads to RCE
Details

PyVista provides 3D plotting and mesh analysis through an interface for the Visualization Toolkit (VTK). Version 0.46.3 of the PyVista Project is vulnerable to remote code execution via dependency confusion. Two pieces of code use--extra-index-url. But when --extra-index-url is used, pip always checks for the PyPI index first, and then the external index. One package listed in the code is not published in PyPI. If an attacker publishes a package with higher version in PyPI, the malicious code from the attacker controlled package may be pulled, leading to remote code execution and a supply chain attack. As of time of publication, a patched version is unavailable.

Database specific 
{
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61774.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/pyvista/pyvista

Affected ranges

Type
GIT
Repo
https://github.com/pyvista/pyvista
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
aabfb3db2b0d4980de9e94e66272240efba4ed95

Affected versions

0.*
0.12.0
0.12.1
0.13.0
0.13.1
0.14.0
0.14.1
0.14.2
0.14.3
0.15.0
0.15.1
0.16.0
0.16.1
0.16.10
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.16.7
0.16.8
0.16.9
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.18.0
0.18.1
0.18.3
0.18.4
0.19.0
0.20.0
0.20.1
0.20.2
0.20.3
0.20.4
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.22.0
0.22.1
0.22.2
0.22.4
0.23.0
0.23.1
0.23.2
0.24.0
0.24.1
0.25.1
0.26.0
0.27.0
0.3.2
0.4.0
0.5.0
0.9.1
0.9.2
0.9.3
v0.*
v0.18.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-61774.json"