How severe is GHSA-xv5p-fjw5-vrj6?

GHSA-xv5p-fjw5-vrj6 has a CVSS score of 8.8/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by GHSA-xv5p-fjw5-vrj6?

GHSA-xv5p-fjw5-vrj6 affects the following packages: fugue (PyPI). Ecosystems affected: PyPI.

How do I fix GHSA-xv5p-fjw5-vrj6?

No patched version of fugue has shipped for GHSA-xv5p-fjw5-vrj6 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.

How do I detect GHSA-xv5p-fjw5-vrj6 in my PyPI dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for fugue. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-xv5p-fjw5-vrj6 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-xv5p-fjw5-vrj6?

O3 pinpoints whether GHSA-xv5p-fjw5-vrj6 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-xv5p-fjw5-vrj6 actively exploited in the wild?

No public exploit code has been indexed for GHSA-xv5p-fjw5-vrj6 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for GHSA-xv5p-fjw5-vrj6?

GHSA-xv5p-fjw5-vrj6 has an EPSS (Exploit Prediction Scoring System) score of 0.6%, placing it in the 46th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

When was GHSA-xv5p-fjw5-vrj6 published, and has it been updated?

GHSA-xv5p-fjw5-vrj6 was published on November 25, 2025 and was last updated on November 27, 2025. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐍 PyPI

GHSA-xv5p-fjw5-vrj6

HIGH

Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer

Also known asCVE-2025-62703

Published

Nov 25, 2025

Updated

Nov 27, 2025

Affected

1 pkg

Patched

None yet

Exploits

None indexed

EPSS Exploitation Probability

via FIRST.org ↗

0.6%probability of exploitation in next 30 days

Lower Risk46th percentile+0.08%

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Blast Radius

1 pkg affected

🐍fugue

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Summary

The Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine.

Details

_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization.

PoC

Step1: The victim user starts an RPC server binding to open network using the Fugue framework. Here, I use the official RPC server code to initialize the server.
Step2: The attacker modifies the _encode() function in fugue/rpc/flask.py to inject malicious pickle data:

In this example, attacker modifies _encode to let the victim execute command “ls -l”

Step 3: The attacker then uses the RPC client to send the malicious request

Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py.

Impact

Remote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:

Complete system compromise
Data exfiltration
Lateral movement within the network
Denial of service attacks
Installation of persistent backdoors

Mitigation

Replace unsafe deserialization: Replace pickle.loads() with safer alternatives such as:
- JSON serialization for simple data structures
- Protocol Buffers or MessagePack for complex data
- If pickle must be used, implement a custom Unpickler with a restricted find_class() method that only allows whitelisted classes
Network security:
- If the service is intended for internal use only, bind to localhost (127.0.0.1) instead of 0.0.0.0
- Implement authentication and authorization mechanisms
Security warnings: When starting the service on public interfaces, display clear security warnings to inform users about the risks.

Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing

Affected Packages

1 total

Ecosystem	Package	Vulnerable range	Fix
🐍PyPI	`fugue`	all versions	No fix

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for fugue. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Remediation status
No patched version of fugue has shipped for GHSA-xv5p-fjw5-vrj6 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-xv5p-fjw5-vrj6 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-xv5p-fjw5-vrj6. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Summary The Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to e

O3 Security · Impact-Aware SCA

Is GHSA-xv5p-fjw5-vrj6 in your dependencies?

O3 detects GHSA-xv5p-fjw5-vrj6 across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works