PT-2025-40909 · Pypi+2 · Python-Socketio+2

Locus-X64

·

Published

2025-10-06

·

Updated

2026-02-16

·

CVE-2025-61765

CVSS v2.0

6.9

Medium

VectorAV:A/AC:L/Au:M/C:C/I:C/A:P
Name of the Vulnerable Software and Affected Versions python-socketio versions prior to 5.14.0
Description python-socketio is a Python implementation of the Socket.IO realtime client and server. A remote code execution issue in python-socketio allows attackers to execute arbitrary Python code through malicious pickle deserialization in multi-server deployments where the attacker has previously gained access to the message queue used for internal communications. The issue stems from deserialization of messages using Python's pickle.loads() function. An attacker can send a crafted pickle payload that executes arbitrary code during deserialization via Python's reduce method. This vulnerability only affects deployments with a compromised message queue. The attack can lead to the attacker executing random code in the context of, and with the privileges of a Socket.IO server process. Single-server systems that do not use a message queue, and multi-server systems with a secure message queue are not vulnerable.
Recommendations Upgrade to python-socketio version 5.14.0 or newer, which removes the pickle module and uses JSON encoding for inter-server messaging.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

Related Identifiers

BDU:2026-03615
CVE-2025-61765
GHSA-G8C6-8FJJ-2R4M
OPENSUSE-SU-2025:15613-1
SUSE-SU-2025:3780-1

Affected Products

Debian
Red Os
Python-Socketio