GHSA-74vm-8frp-7w68

Source

https://github.com/advisories/GHSA-74vm-8frp-7w68

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-74vm-8frp-7w68/GHSA-74vm-8frp-7w68.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-74vm-8frp-7w68

Aliases

CVE-2026-25632

Published

2026-02-04T20:34:28Z

Modified

2026-02-06T22:20:28.355807Z

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)

Details

Impact

EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (myloadfrom_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files.

Patches

EPyT-Flow has been patched in 0.16.1 -- affects all versions <= 0.16.0

Workarounds

Do not load any JSON from untrusted sources and do not expose the REST API.

Credits

EPyT-Flow thanks Jarrett Chan (@syphonetic) for detecting and reporting the bug.

Database specific

{
    "cwe_ids": [
        "CWE-502"
    ],
    "github_reviewed_at": "2026-02-04T20:34:28Z",
    "nvd_published_at": "2026-02-06T21:16:18Z",
    "severity": "CRITICAL",
    "github_reviewed": true
}

References

Affected packages

PyPI / epyt-flow

Package

Name: epyt-flow; View open source insights on deps.dev
Purl: pkg:pypi/epyt-flow

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.16.1

Affected versions

0.*

0.1.0

0.1.1

0.2.0

0.3.0

0.4.0

0.5.0

0.6.0

0.7.0

0.7.1

0.7.2

0.7.3

0.8.0

0.8.1

0.9.0

0.10.0

0.11.0

0.12.0

0.13.0

0.13.1

0.14.0

0.14.1

0.14.2

0.15.0b1

0.15.0

0.16.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-74vm-8frp-7w68/GHSA-74vm-8frp-7w68.json"