All vulnerabilities
CVE-2026-25632GHSA-74vm-8frp-7w68PYSEC-2026-330

EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)

WaterFutures epyt-flowpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
10.0Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.81%Chance of exploitation activity in the next 30 days, higher than 56% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in0.16.1Fixed versionGitHub
Published6 Feb 2026Updated 27 Oct 2026CVE List

What fixes it

  • 0.16.1epyt-flow, pipGitHub
  • 0.16.1epyt-flow, PyPIOSVpip install "epyt-flow>=0.16.1"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a __type__ field. When __type__ is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files.

Patches

EPyT-Flow has been patched in 0.16.1 -- affects all versions <= 0.16.0

Workarounds

Do not load any JSON from untrusted sources and do not expose the REST API.

Credits

EPyT-Flow thanks Jarrett Chan (@syphonetic) for detecting and reporting the bug.

Text from GitHub Advisory Database

Affected versions 28

  • epyt-flow, pip< 0.16.1GitHub
  • EPyT-Flowaffected: < 0.16.1CVE List
  • epyt-flow, PyPIfrom first release, fixed in 0.16.1OSV
  • epyt-flow, PyPI0.1.0OSV
  • epyt-flow, PyPI0.1.1OSV
  • epyt-flow, PyPI0.10.0OSV
  • epyt-flow, PyPI0.11.0OSV
  • epyt-flow, PyPI0.12.0OSV
  • epyt-flow, PyPI0.13.0OSV
  • epyt-flow, PyPI0.13.1OSV
  • epyt-flow, PyPI0.14.0OSV
  • epyt-flow, PyPI0.14.1OSV
  • epyt-flow, PyPI0.14.2OSV
  • epyt-flow, PyPI0.15.0OSV
  • epyt-flow, PyPI0.15.0b1OSV
  • epyt-flow, PyPI0.16.0OSV
  • epyt-flow, PyPI0.2.0OSV
  • epyt-flow, PyPI0.3.0OSV
  • epyt-flow, PyPI0.4.0OSV
  • epyt-flow, PyPI0.5.0OSV
  • epyt-flow, PyPI0.6.0OSV
  • epyt-flow, PyPI0.7.0OSV
  • epyt-flow, PyPI0.7.1OSV
  • epyt-flow, PyPI0.7.2OSV
  • epyt-flow, PyPI0.7.3OSV
  • epyt-flow, PyPI0.8.0OSV
  • epyt-flow, PyPI0.8.1OSV
  • epyt-flow, PyPI0.9.0OSV

References 7