CVE-2025-58367
BaseFortify
Publication date: 2025-09-05
Last updated on: 2025-09-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| seperman | deepdiff | 8.6.1 |
| seperman | deepdiff | 5.0.0 |
| seperman | deepdiff | 8.6.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-915 | The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
Upgrade DeepDiff to version 8.6.1 or later, as this version contains the fix for the vulnerability. Avoid using vulnerable versions (5.0.0 through 8.6.0) especially in environments where user-controlled input is passed to the Delta class constructor. Additionally, avoid insecure Pickle deserialization and do not allow modification of deepdiff.serialization.SAFE_TO_IMPORT to include dangerous classes.
Can you explain this vulnerability to me?
This vulnerability affects DeepDiff versions 5.0.0 through 8.6.0 and involves class pollution via the Delta class constructor. When combined with a gadget in DeltaDiff, it can lead to Denial of Service and Remote Code Execution through insecure Pickle deserialization. The vulnerability allows modification of deepdiff.serialization.SAFE_TO_IMPORT to include dangerous classes like posix.system, enabling execution of arbitrary Python code if the input to Delta is user-controlled. It is fixed in version 8.6.1.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to execute arbitrary Python code remotely, potentially causing Denial of Service or full Remote Code Execution on systems using vulnerable versions of DeepDiff. This can compromise the security and integrity of the affected application and its environment.