CVE-2025-62515

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62515", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-15T15:03:28.134Z", "datePublished": "2025-10-17T20:38:43.957Z", "dateUpdated": "2025-10-17T20:56:21.532Z"}, "containers": {"cna": {"title": "Remote Code Execution by Pickle Deserialization via FlightServer in pyquokka", "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/marsupialtail/quokka/security/advisories/GHSA-f74j-gffq-vm9p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/marsupialtail/quokka/security/advisories/GHSA-f74j-gffq-vm9p"}], "affected": [{"vendor": "marsupialtail", "product": "quokka", "versions": [{"version": "<= 3.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-17T20:38:43.957Z"}, "descriptions": [{"lang": "en", "value": "pyquokka is a framework for making data lakes work for time series. In versions 0.3.1 and prior, the FlightServer class directly uses pickle.loads() to deserialize action bodies received from Flight clients without any sanitization or validation in the do_action() method. The vulnerable code is located in pyquokka/flight.py at line 283 where arbitrary data from Flight clients is directly passed to pickle.loads(). When FlightServer is configured to listen on 0.0.0.0, this allows attackers across the entire network to perform arbitrary remote code execution by sending malicious pickled payloads through the set_configs action. Additional vulnerability points exist in the cache_garbage_collect, do_put, and do_get functions where pickle.loads is used to deserialize untrusted remote data."}], "source": {"advisory": "GHSA-f74j-gffq-vm9p", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-17T20:56:13.253089Z", "id": "CVE-2025-62515", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-17T20:56:21.532Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62515", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-17T20:56:13.253089Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-17T20:56:17.729Z"}}], "cna": {"title": "Remote Code Execution by Pickle Deserialization via FlightServer in pyquokka", "source": {"advisory": "GHSA-f74j-gffq-vm9p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "marsupialtail", "product": "quokka", "versions": [{"status": "affected", "version": "<= 3.0.1"}]}], "references": [{"url": "https://github.com/marsupialtail/quokka/security/advisories/GHSA-f74j-gffq-vm9p", "name": "https://github.com/marsupialtail/quokka/security/advisories/GHSA-f74j-gffq-vm9p", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "pyquokka is a framework for making data lakes work for time series. In versions 0.3.1 and prior, the FlightServer class directly uses pickle.loads() to deserialize action bodies received from Flight clients without any sanitization or validation in the do_action() method. The vulnerable code is located in pyquokka/flight.py at line 283 where arbitrary data from Flight clients is directly passed to pickle.loads(). When FlightServer is configured to listen on 0.0.0.0, this allows attackers across the entire network to perform arbitrary remote code execution by sending malicious pickled payloads through the set_configs action. Additional vulnerability points exist in the cache_garbage_collect, do_put, and do_get functions where pickle.loads is used to deserialize untrusted remote data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-17T20:38:43.957Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62515", "state": "PUBLISHED", "dateUpdated": "2025-10-17T20:56:21.532Z", "dateReserved": "2025-10-15T15:03:28.134Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-17T20:38:43.957Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "quokka", "vendor": "marsupialtail", "versions": [{"status": "affected", "version": "<= 3.0.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "pyquokka is a framework for making data lakes work for time series. In versions 0.3.1 and prior, the FlightServer class directly uses pickle.loads() to deserialize action bodies received from Flight clients without any sanitization or validation in the do_action() method. The vulnerable code is located in pyquokka/flight.py at line 283 where arbitrary data from Flight clients is directly passed to pickle.loads(). When FlightServer is configured to listen on 0.0.0.0, this allows attackers across the entire network to perform arbitrary remote code execution by sending malicious pickled payloads through the set_configs action. Additional vulnerability points exist in the cache_garbage_collect, do_put, and do_get functions where pickle.loads is used to deserialize untrusted remote data."}, {"lang": "es", "value": "pyquokka es un framework para hacer que los data lakes funcionen para series temporales. En las versiones 0.3.1 y anteriores, la clase FlightServer utiliza directamente pickle.loads() para deserializar los cuerpos de acci\u00f3n recibidos de los clientes Flight sin ninguna sanitizaci\u00f3n o validaci\u00f3n en el m\u00e9todo do_action(). El c\u00f3digo vulnerable se encuentra en pyquokka/flight.py en la l\u00ednea 283 donde datos arbitrarios de los clientes Flight se pasan directamente a pickle.loads(). Cuando FlightServer est\u00e1 configurado para escuchar en 0.0.0.0, esto permite a los atacantes de toda la red realizar ejecuci\u00f3n remota de c\u00f3digo arbitraria enviando cargas \u00fatiles pickled maliciosas a trav\u00e9s de la acci\u00f3n set_configs. Puntos de vulnerabilidad adicionales existen en las funciones cache_garbage_collect, do_put y do_get donde pickle.loads se utiliza para deserializar datos remotos no confiables."}], "id": "CVE-2025-62515", "lastModified": "2026-10-08T22:10:00.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62515", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-17T20:56:13.253089Z", "version": "2.0.3"}}]}, "published": "2025-10-17T21:15:36.783", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/marsupialtail/quokka/security/advisories/GHSA-f74j-gffq-vm9p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-20T13:21:53.656225+00:00", "updated": "2025-10-20T13:21:53.656259+00:00", "vendors": ["marsupialtail", "marsupialtail$PRODUCT$quokka"]}