CVE-2026-25632

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25632", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-04T05:15:41.790Z", "datePublished": "2026-02-06T20:24:18.213Z", "dateUpdated": "2026-02-06T20:56:43.719Z"}, "containers": {"cna": {"title": "EPyT-Flow has unsafe JSON deserialization (__type__)", "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/WaterFutures/EPyT-Flow/security/advisories/GHSA-74vm-8frp-7w68", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WaterFutures/EPyT-Flow/security/advisories/GHSA-74vm-8frp-7w68"}, {"name": "https://github.com/WaterFutures/EPyT-Flow/commit/3fff9151494c7dbc72073830b734f0a7e550e385", "tags": ["x_refsource_MISC"], "url": "https://github.com/WaterFutures/EPyT-Flow/commit/3fff9151494c7dbc72073830b734f0a7e550e385"}, {"name": "https://github.com/WaterFutures/EPyT-Flow/releases/tag/v0.16.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/WaterFutures/EPyT-Flow/releases/tag/v0.16.1"}], "affected": [{"vendor": "WaterFutures", "product": "EPyT-Flow", "versions": [{"version": "< 0.16.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T20:24:18.213Z"}, "descriptions": [{"lang": "en", "value": "EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow\u2019s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files. This vulnerability is fixed in 0.16.1."}], "source": {"advisory": "GHSA-74vm-8frp-7w68", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-06T20:56:14.947947Z", "id": "CVE-2026-25632", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T20:56:43.719Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25632", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-06T20:56:14.947947Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T20:56:34.510Z"}}], "cna": {"title": "EPyT-Flow has unsafe JSON deserialization (__type__)", "source": {"advisory": "GHSA-74vm-8frp-7w68", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "WaterFutures", "product": "EPyT-Flow", "versions": [{"status": "affected", "version": "< 0.16.1"}]}], "references": [{"url": "https://github.com/WaterFutures/EPyT-Flow/security/advisories/GHSA-74vm-8frp-7w68", "name": "https://github.com/WaterFutures/EPyT-Flow/security/advisories/GHSA-74vm-8frp-7w68", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/WaterFutures/EPyT-Flow/commit/3fff9151494c7dbc72073830b734f0a7e550e385", "name": "https://github.com/WaterFutures/EPyT-Flow/commit/3fff9151494c7dbc72073830b734f0a7e550e385", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/WaterFutures/EPyT-Flow/releases/tag/v0.16.1", "name": "https://github.com/WaterFutures/EPyT-Flow/releases/tag/v0.16.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow\u2019s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files. This vulnerability is fixed in 0.16.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T20:24:18.213Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25632", "state": "PUBLISHED", "dateUpdated": "2026-02-06T20:56:43.719Z", "dateReserved": "2026-02-04T05:15:41.790Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-06T20:24:18.213Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "EPyT-Flow", "vendor": "WaterFutures", "versions": [{"status": "affected", "version": "< 0.16.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:waterfutures:epyt-flow:*:*:*:*:*:python:*:*", "matchCriteriaId": "58884503-AFDE-408F-994A-A94C23E8AC3C", "versionEndExcluding": "0.16.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow\u2019s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files. This vulnerability is fixed in 0.16.1."}, {"lang": "es", "value": "EPyT-Flow es un paquete de Python dise\u00f1ado para la f\u00e1cil generaci\u00f3n de datos de escenarios hidr\u00e1ulicos y de calidad del agua de redes de distribuci\u00f3n de agua. Antes de la versi\u00f3n 0.16.1, la API REST de EPyT-Flow analiza cuerpos de solicitud JSON controlados por el atacante utilizando un deserializador personalizado (my_load_from_json) que soporta un campo type. Cuando type est\u00e1 presente, el deserializador importa din\u00e1micamente un m\u00f3dulo/clase especificado por el atacante y lo instancia con argumentos proporcionados por el atacante. Esto permite invocar clases peligrosas como subprocess.Popen, lo que puede llevar a la ejecuci\u00f3n de comandos del sistema operativo durante el an\u00e1lisis JSON. Esto tambi\u00e9n afecta la carga de archivos JSON. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.16.1."}], "id": "CVE-2026-25632", "lastModified": "2026-06-17T10:24:58.957", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25632", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-06T20:56:14.947947Z", "version": "2.0.3"}}]}, "published": "2026-02-06T21:16:18.377", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/WaterFutures/EPyT-Flow/commit/3fff9151494c7dbc72073830b734f0a7e550e385"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/WaterFutures/EPyT-Flow/releases/tag/v0.16.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/WaterFutures/EPyT-Flow/security/advisories/GHSA-74vm-8frp-7w68"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T22:27:27.595232+00:00", "value": {"mitigation_remediation": ["Upgrade EPyT\u2011Flow to version 0.16.1 or later, which removes the unsafe deserializer.", "If an immediate upgrade is not possible, block or remove the REST endpoint that processes JSON requests to prevent the deserializer from being invoked.", "Alternatively, configure the application to reject any JSON payload containing a type field or modify the code to whitelist only safe, predefined classes, thereby eliminating untrusted dynamic imports.", "Review and harden any JSON file ingestion paths to avoid deserializing untrusted data."], "summary": {"action": "Immediate Patch", "impact": "Remote code execution via unsafe JSON deserialization"}, "threat_synthesis": {"affected_systems": "WaterFutures EPyT\u2011Flow versions prior to 0.16.1 are affected. Any installation that exposes the REST API or accepts JSON files without proper validation is vulnerable. The issue spans all platforms supported by the Python package, and any deployment that uses the my_load_from_json routine is susceptible.", "description_and_impact": "The flaw resides in EPyT\u2011Flow\u2019s REST API and JSON file loader, which employ a custom deserializer that accepts a type field. When present, the deserializer dynamically imports the specified module or class and instantiates it with supplied arguments, allowing malicious actors to load and invoke dangerous classes such as subprocess.Popen. This mechanism directly permits arbitrary OS command execution during JSON parsing, giving attackers full control over the host system.", "risk_and_exploitability": "The CVSS score of 10 highlights worst\u2011case severity. The EPSS score is below 1%, indicating limited exploitation activity, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs to reach the REST API endpoint or supply a malicious JSON document; the dynamic import process then executes the payload with the privileges of the running Python process, resulting in complete system compromise."}}}}, "created": "2026-02-09T10:50:15.851342+00:00", "updated": "2026-04-17T22:30:29.597811+00:00", "vendors": ["waterfutures", "waterfutures$PRODUCT$epyt-flow"]}