# CVE-2025-62703: fugue RCE (High 8.8) 🐍 🐍 PyPI Not in CISA KEV HIGH severity # CVE-2025-62703 — fugue HIGH [Fix: fugue-project/fugue@6f25326](https://github.com/fugue-project/fugue/commit/6f25326779fd1f528198098d6287c5a863176fc0) CVE-2025-62703 is a high-severity (CVSS 8.8) Deserialization of Untrusted Data vulnerability in fugue. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime. Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer Also known as[GHSA-xv5p-fjw5-vrj6](/vulnerability/GHSA-xv5p-fjw5-vrj6)PYSEC-2026-1399 Published Nov 25, 2025 Updated Oct 28, 2026 Affected 1 pkg Patched See advisory Exploits None indexed Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. - A successful exploit gives an attacker total control of the affected component, not partial access. Exploitation and automatability from CISA’s SSVC triage for CVE-2025-62703. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.8%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs56th percentile — riskier than 56% of all scored CVEsHighest risk 0.06%0.47%0.88%1.28%0.6%0.8%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected 🐍`fugue` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems. ## Description #### Summary The Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the \_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. #### Details \_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. #### PoC - Step1: The victim user starts an RPC server binding to open network using the Fugue framework. Here, I use the official RPC server code to initialize the server. - Step2: The attacker modifies the \_encode() function in fugue/rpc/flask.py to inject malicious pickle data: image In this example, attacker modifies \_encode to let the victim execute command “ls -l” - Step 3: The attacker then uses the RPC client to send the malicious request Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc\_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc\_client.py. #### Impact Remote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for: - Complete system compromise - Data exfiltration - Lateral movement within the network - Denial of service attacks - Installation of persistent backdoors #### Mitigation 1. **Replace unsafe deserialization**: Replace `pickle.loads()` with safer alternatives such as: - JSON serialization for simple data structures - Protocol Buffers or MessagePack for complex data - If pickle must be used, implement a custom `Unpickler` with a restricted `find_class()` method that only allows whitelisted classes 2. **Network security**: - If the service is intended for internal use only, bind to localhost (`127.0.0.1`) instead of `0.0.0.0` - Implement authentication and authorization mechanisms 3. **Security warnings**: When starting the service on public interfaces, display clear security warnings to inform users about the risks. Attachment: [https://drive.google.com/file/d/1y8bBBp7dnWoT\_WHBtdB0Fts4NRUIfdWi/view?usp=sharing](https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing) ## Affected Packages 1 total Ecosystem Package Vulnerable range Fix 🐍PyPI `fugue` all versions No fix ## Affected Products 1 product · 1 configurations Application `fugue`fugue-project ≤ 0.9.1 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for fugue, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Remediation status The records we use list no patched version of fugue for CVE-2025-62703. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range. 3. ### Mitigate without a patch Do not deserialise data from untrusted sources: where the format allows it, restrict deserialisation to an explicit allowlist of expected types, and prefer a data-only format (JSON, Protobuf) over one that can reconstruct arbitrary objects until you can upgrade. ## Frequently Asked Questions \### Summary The Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the \_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to e O3 Security · Impact-Aware SCA ### Is CVE-2025-62703 in your dependencies? Find it across PyPI, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)