PT-2025-26242 · Upsonic · Upsonic

Resp4Ss · Published 2025-06-19 · Updated 2025-06-20 · CVE-2025-6279

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Upsonic versions up to 0.55.6

Description A critical issue has been found in the Pickle Handler component of Upsonic, affecting the cloudpickle.loads function. This issue leads to deserialization. The exploit has been disclosed to the public and may be used.

Recommendations For versions up to 0.55.6, consider disabling the cloudpickle.loads function in the Pickle Handler component as a temporary workaround until a patch is available. Restrict access to the /tools/add tool file to minimize the risk of exploitation.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-6279

GHSA-RPFV-46XJ-5984

PYSEC-2025-68

Affected Products

Upsonic

References · 19

• 🔥 https://github.com/Upsonic/Upsonic/issues/353 · Exploit
• https://osv.dev/vulnerability/CVE-2025-6279 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6279 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-68 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rpfv-46xj-5984 · Vendor Advisory
• https://github.com/Upsonic/Upsonic · Note
• https://github.com/Upsonic/Upsonic/pull/360#issuecomment-2979387098 · Note
• https://github.com/Upsonic/Upsonic/commit/a54529acc6e4bfe28f4f5c80c058144348a306b7 · Note
• https://github.com/Upsonic/Upsonic/pull/360 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/upsonic/PYSEC-2025-68.yaml · Note
• https://vuldb.com/?submit.593099 · Note
• https://twitter.com/CVEnew/status/1935812713508110788 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1935813861954793664 · Twitter Post
• https://vuldb.com/?id.313283 · Note
• https://vuldb.com/?ctiid.313283 · Note