PT-2025-45693 · Pypi · Cryptidy

Published 2025-10-31 · Updated 2025-10-31

OSV

CVSS v3.1

6.9

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes decrypt message in symmetric encryption.py.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

GHSA-97W9-V595-3H5Q

Affected Products

Cryptidy

References · 5

• https://osv.dev/vulnerability/GHSA-97w9-v595-3h5q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63675 · Security Note
• https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.py#L220-L238 · Note
• https://github.com/netinvent/cryptidy · Note
• https://github.com/javiermorales36/cryptidy-analysis · Note