{"id":"CVE-2026-25632","aliases":["GHSA-74vm-8frp-7w68","PYSEC-2026-330"],"url":"https://o3.security/vulnerability/CVE-2026-25632","summary":"EPyT-Flow has unsafe JSON deserialization (__type__)","details":"### Impact\nEPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a __type__ field. When __type__ is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files.\n\n### Patches\nEPyT-Flow  has been patched in 0.16.1 -- affects all versions <= 0.16.0\n\n### Workarounds\nDo not load any JSON from untrusted sources and do not expose the REST API.\n\n### Credits\nEPyT-Flow  thanks Jarrett Chan (@syphonetic) for detecting and reporting the bug.","published":"2026-02-06T20:24:18.213Z","modified":"2026-08-12T03:51:15.607664461Z","cvss":{"score":10,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"epss":{"score":0.00695,"percentile":0.50284,"asOf":"2026-08-22"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"epyt-flow","fixedVersion":"0.16.1"}],"fix":{"url":"https://github.com/WaterFutures/EPyT-Flow/commit/3fff9151494c7dbc72073830b734f0a7e550e385","label":"WaterFutures/EPyT-Flow@3fff915"},"references":[{"type":"WEB","url":"https://github.com/WaterFutures/EPyT-Flow/releases/tag/v0.16.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25632.json"},{"type":"ADVISORY","url":"https://github.com/WaterFutures/EPyT-Flow/security/advisories/GHSA-74vm-8frp-7w68"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25632"},{"type":"FIX","url":"https://github.com/WaterFutures/EPyT-Flow/commit/3fff9151494c7dbc72073830b734f0a7e550e385"},{"type":"PACKAGE","url":"https://github.com/WaterFutures/EPyT-Flow"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:15.607664461Z"}}