Loading story…
A critical remote code execution (RCE) vulnerability was disclosed in the PyPI-distributed PLY (Python Lex-Yacc) 3.11 library, tracked as CVE-2025-56005 (reported with CVSS 9.8). The issue stems from an undocumented picklefile parameter in yacc() that triggers pickle.load() on an attacker-controlled file without validation, enabling arbitrary code execution during deserialization (e.g., via __reduce__()) before parser initialization completes. Reporting noted the risk is amplified because execution can occur silently at application startup, prior to any parsing logic.
Exploitation is feasible in environments where parser tables or build artifacts are cached or shared, including cached parser table locations, shared network directories, and CI/CD pipeline artifacts, if an attacker can influence or replace the referenced pickle file or its path. A proof-of-concept was described demonstrating that a crafted pickle can execute system commands as soon as yacc(picklefile=...) is invoked. Separately, a different Python ecosystem issue was also reported: CVE-2026-0994 in Google Protocol Buffers Python JSON parsing (google.protobuf.json_format.ParseDict()), where nested google.protobuf.Any messages can bypass recursion-depth accounting and crash services via DoS—but this is unrelated to the PLY RCE.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The vulnerability was publicly documented as CVE-2025-56005 with a CVSS score of 9.8, and reporting described a proof of concept showing system command execution during parser initialization. Public guidance advised users to avoid the `picklefile` parameter, audit code paths influencing `yacc()` arguments, and treat related pickle files as untrusted.
Security researcher Bohmiiidd identified a critical remote code execution flaw in the PyPI-distributed PLY 3.11 package. The issue stems from an undocumented `picklefile` parameter in `yacc()` that deserializes attacker-controlled data with `pickle.load()` without validation.
The PLY (Python Lex-Yacc) project's maintainer announced that the library was being abandoned, leaving the package without expected future maintenance. This set the context for later concern that no official fix would likely be issued for newly found flaws.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution vulnerability, tracked as **CVE-2021-47952**, affects the Python `jsonpickle` library through unsafe deserialization of untrusted JSON. In `jsonpickle` 2.0.0, applications that pass attacker-controlled data to `jsonpickle.decode()` can be compromised because the `py/repr` tag is processed by an internal repr-loading path that forwards input into Python's `eval()`, allowing arbitrary code execution with the privileges of the running process. The issue requires no authentication, special privileges, or user interaction beyond the target application decoding malicious input. Public exploit details show the flaw can be triggered remotely with crafted serialized data containing a `py/repr` field, enabling execution of arbitrary Python commands and potentially system-level calls on both Windows and Linux. Earlier reporting said the behavior existed for backward compatibility across versions and initially lacked a patch, while later project changes reportedly removed reliance on `eval()` and disabled legacy repr object support by default, reflecting a broader pattern of deserialization risk in the project.
Jul 10, 2026
A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-61622, was discovered in the Apache Fory Python module, specifically affecting pyfory versions 0.12.0 through 0.12.2 and legacy pyfury versions from 0.1.0 through 0.10.3. The flaw arises from the deserialization of untrusted data, where the module's pickle fallback serializer can be triggered by a crafted data stream, leading to the execution of arbitrary code via Python's 'pickle.loads' function. This vulnerability is considered critical, with a CVSS score of 9.8, indicating a high risk of exploitation. Applications that read pyfory serialized data from untrusted sources are particularly at risk, as attackers can exploit this vector to achieve remote code execution on affected systems. The Apache security team has addressed the issue by removing the pickle fallback serializer in pyfory version 0.12.3 and later, effectively mitigating the vulnerability. Security advisories recommend immediate upgrades to the fixed version to prevent exploitation. The vulnerability was publicly disclosed on October 1, 2025, with Apache providing detailed guidance and crediting their security team for the discovery and remediation. The flaw is remotely exploitable, making it a significant concern for organizations using affected versions in production environments. No evidence of active exploitation in the wild has been reported at the time of disclosure, but the technical simplicity of the attack vector increases the urgency for patching. The vulnerability impacts any application that processes serialized data from untrusted sources using the affected pyfory or pyfury versions. Organizations are advised to audit their environments for the presence of vulnerable versions and to apply the recommended updates without delay. The security community has highlighted the risk of deserialization vulnerabilities in Python applications, emphasizing the importance of avoiding unsafe serialization mechanisms like pickle. Apache's response included not only a patch but also updated documentation warning against insecure deserialization practices. The incident underscores the ongoing risks associated with legacy serialization features in widely used open-source libraries. Security researchers have praised the transparency and speed of Apache's response to the issue. The vulnerability has been cataloged in major vulnerability databases, and security vendors have updated their detection signatures accordingly.
Jun 29, 2026
NLTK addressed multiple pickle deserialization weaknesses that could let attackers execute arbitrary Python code by supplying malicious model files. An advisory said versions up to **3.9.4** were vulnerable in `TransitionParser.parse()`, where `pickle_load()` used an unsafe path that allowed arbitrary class resolution during deserialization; the issue was fixed in **NLTK 3.10.0**. The project had already introduced safer loaders in `picklesec.py`, including `RestrictedUnpickler`, `WarningUnpickler`, and `AllowlistUnpickler`, and warned that pickle files should be loaded only from trusted sources. A later hardening update tightened those protections after bypasses were identified in the allowlist logic. The patch closed remote-code-execution paths by rejecting dotted names, blocking dangerous module prefixes, denying specific risky globals and dunder names, and replacing broad module-prefix allowlists for Punkt model loading with exact global allowlists. The changes specifically targeted gadget access through objects such as `sklearn.os.system`, `numpy.f2py.crackfortran.myeval`, `nltk.tokenize.repp.ReppTokenizer._execute`, and `numpy.load`, while regression tests were added to ensure malicious payloads are blocked and legitimate NLTK and scientific-stack objects still deserialize correctly.
Aug 25, 2026