Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-25632 is a critical vulnerability in the EPyT-Flow Python package versions prior to 0.16.1. The issue lies in the package's REST API and JSON file loading functionality, where a custom JSON deserializer called my_load_from_json processes attacker-controlled JSON request bodies containing a type field. When this field is present, the deserializer dynamically imports and instantiates the specified module/class using attacker-supplied arguments. This behavior allows attackers to invoke dangerous classes such as subprocess.Popen, leading to arbitrary operating system command execution during JSON parsing."}, {'type': 'paragraph', 'content': 'The vulnerability requires no privileges or user interaction and can be exploited remotely over the network. It results in a scope change, allowing an attacker to compromise confidentiality, integrity, and availability at a high level. The underlying weakness is classified as CWE-502: Deserialization of Untrusted Data. The issue was fixed in EPyT-Flow version 0.16.1 by introducing strict validation and limiting deserialization to pre-registered safe classes.'}] [1, 3]

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability can have severe impacts because it allows an attacker to execute arbitrary operating system commands remotely without any privileges or user interaction. Exploiting this flaw can lead to a complete compromise of the affected system's confidentiality, integrity, and availability."}, {'type': 'list_item', 'content': 'Remote code execution enabling full system compromise.'}, {'type': 'list_item', 'content': 'Potential unauthorized access to sensitive data.'}, {'type': 'list_item', 'content': 'Disruption or denial of service of the affected application or system.'}] [1]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for usage of the vulnerable EPyT-Flow REST API versions prior to 0.16.1 that parse JSON request bodies containing a type field which triggers unsafe deserialization.'}, {'type': 'paragraph', 'content': 'Since the vulnerability involves unsafe JSON deserialization allowing remote code execution, detection can focus on identifying suspicious JSON payloads sent to the REST API, especially those containing a type field that attempts to instantiate dangerous classes like subprocess.Popen.'}, {'type': 'paragraph', 'content': 'Network detection can include inspecting HTTP requests to the EPyT-Flow REST API endpoints for JSON bodies with a type field or unusual module/class names.'}, {'type': 'paragraph', 'content': 'Suggested commands for detection might include using network traffic analysis tools such as tcpdump or Wireshark to capture and filter HTTP POST requests to the EPyT-Flow API, for example:'}, {'type': 'list_item', 'content': "tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'type'"}, {'type': 'list_item', 'content': "grep -r 'type' /path/to/epyt-flow/logs/ # to find suspicious JSON payloads in logs"}, {'type': 'paragraph', 'content': 'Additionally, checking the installed EPyT-Flow package version can help identify if the system is vulnerable:'}, {'type': 'list_item', 'content': 'pip show epyt-flow'}, {'type': 'paragraph', 'content': 'If the version is prior to 0.16.1, the system is vulnerable.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation steps for this vulnerability are to upgrade EPyT-Flow to version 0.16.1 or later, where the unsafe JSON deserialization issue has been fixed.

Until the upgrade can be performed, it is recommended to avoid loading JSON data from untrusted sources and to not expose the vulnerable REST API to untrusted networks.

Specifically:

• Upgrade EPyT-Flow to version 0.16.1 or newer.
• Restrict access to the EPyT-Flow REST API to trusted users and networks only.
• Avoid processing JSON files or requests from untrusted or unauthenticated sources.
• Review and apply any additional security patches or configuration changes included in the 0.16.1 release.

Useful 0 Not Useful 0