PT-2025-36336 · Deepdiff · Deepdiff

Diogotcorreia · Published 2025-09-03 · Updated 2025-09-28 · CVE-2025-58367

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions DeepDiff versions 5.0.0 through 8.6.0

Description DeepDiff is a Python project for deep difference and search of data. Versions 5.0.0 through 8.6.0 are susceptible to class pollution through the Delta class constructor. When combined with a gadget in DeltaDiff, this can lead to Denial of Service and Remote Code Execution via insecure Pickle deserialization. The gadget allows modification of deepdiff.serialization.SAFE TO IMPORT to permit dangerous classes, such as posix.system, enabling the execution of arbitrary Python code through user-controlled input to the Delta class.

Recommendations Update to DeepDiff version 8.6.1 or later.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2025-58367

GHSA-MW26-5G2V-HQW3

OPENSUSE-SU-2025:15536-1

SUSE-SU-2025:03127-1

Affected Products

Deepdiff

References · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58367.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-58367 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mw26-5g2v-hqw3 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15536-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58367 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58367 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-58367 · Security Note
• https://ubuntu.com/security/CVE-2025-58367 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03127-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-58367 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-58367 · Vendor Advisory
• https://github.com/qlustered/deepdiff/security/advisories/GHSA-mw26-5g2v-hqw3 · Note
• https://github.com/seperman/deepdiff · Note
• https://github.com/seperman/deepdiff/releases/tag/8.6.1 · Note
• https://github.com/seperman/deepdiff/security/advisories/GHSA-mw26-5g2v-hqw3 · Note