PT-2026-6657 · Epyt-Flow · Epyt-Flow
Syphonetic
·
Publicado
2026-02-04
·
Atualizado
2026-02-07
·
CVE-2026-25632
CVSS v3.1
10
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
EPyT-Flow versions prior to 0.16.1
Description
EPyT-Flow is a Python package used for generating hydraulic and water quality scenario data for water distribution networks. The REST API parses attacker-controlled JSON request bodies using a custom deserializer,
my load from json, which supports a type field. When this field is present, the deserializer dynamically imports and instantiates a module/class specified by the attacker, with arguments also supplied by the attacker. This allows the invocation of dangerous classes like subprocess.Popen, potentially leading to operating system command execution during JSON parsing. This issue also affects the loading of JSON files. The type field is used in the deserialization process.Recommendations
Versions prior to 0.16.1 should be updated to version 0.16.1.
Do not load JSON data from untrusted sources.
Do not expose the REST API.
Exploit
Correção
RCE
Deserialization of Untrusted Data
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Epyt-Flow