PT-2025-40952 · Vtk+2 · Vtk+2

Slvignesh05 · Published 2025-10-06 · Updated 2025-10-09 · CVE-2025-61774

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions PyVista version 0.46.3

Description PyVista, a software for 3D plotting and mesh analysis using the Visualization Toolkit (VTK), is susceptible to remote code execution through a dependency confusion issue. The software’s use of the --extra-index-url option in pip, combined with a package not published on PyPI, creates a vulnerability. An attacker could publish a malicious package with a higher version number on PyPI, potentially leading to the execution of attacker-controlled code and a supply chain attack. The --extra-index-url parameter allows pip to check for packages in an external index after checking the PyPI index.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-61774

GHSA-XR7F-QCJC-63RV

Affected Products

Debian

Pyvista

Vtk

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61774.json · Exploit
• https://ubuntu.com/security/CVE-2025-61774 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-61774 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-61774 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-61774 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61774 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-61774 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61774 · Security Note
• https://github.com/pyvista/pyvista/commit/aabfb3db2b0d4980de9e94e66272240efba4ed95 · Note
• https://github.com/pyvista/pyvista/blob/c96e1ddbe707fb7d3eb574dc3336de1a946f14a1/.devcontainer/offscreen/oncreatecommand.sh#L4 · Note
• https://github.com/pyvista/pyvista/blob/c96e1ddbe707fb7d3eb574dc3336de1a946f14a1/docker/slim.Dockerfile#L13 · Note
• https://github.com/pyvista/pyvista/security/advisories/GHSA-xr7f-qcjc-63rv · Note
• https://t.me/CVEtracker/34282 · Telegram Post
• https://t.me/cveNotify/137589 · Telegram Post
• https://twitter.com/0dayPublishing/status/1975326215968833671 · Twitter Post