PT-2025-48089 · Fugue+1 · Fugue+1

Chenpinji · Published 2025-11-25 · Updated 2025-12-30 · CVE-2025-62703

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fugue versions 0.9.2 and earlier

Description Fugue is a unified interface for distributed computing. A remote code execution issue exists due to insecure deserialization of data using cloudpickle.loads() within the decode() function in fugue/rpc/flask.py. This allows an attacker to execute arbitrary code on a victim's machine by sending malicious pickle data through the RPC server. The vulnerability resides in the RPC communication mechanism, where a client can transmit serialized Python objects that are deserialized on the server side without proper sanitization.

Recommendations Versions prior to 0.9.2 should be updated.

Exploit

Fix

RCE

Deserialization of Untrusted Data

OS Command Injection

Weakness Enumeration

CWE-502

CWE-78

Related Identifiers

CVE-2025-62703

GHSA-XV5P-FJW5-VRJ6

Affected Products

Fugue

Cloudpickle

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62703.json · Exploit
• 🔥 https://github.com/fugue-project/fugue/security/advisories/GHSA-xv5p-fjw5-vrj6 · Exploit
• https://github.com/fugue-project/fugue/commit/6f25326779fd1f528198098d6287c5a863176fc0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-62703 · Security Note
• https://osv.dev/vulnerability/GHSA-xv5p-fjw5-vrj6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62703 · Vendor Advisory
• https://github.com/fugue-project/fugue · Note
• https://reddit.com/r/VulnMatter/comments/1pbe9h1/resumen_diario_de_vulnerabilidades_01122025 · Reddit Post
• https://t.me/cveNotify/147170 · Telegram Post
• https://twitter.com/CVEnew/status/1993435379366773067 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1p9dokj/resumen_diario_de_vulnerabilidades_29112025 · Reddit Post
• https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing · Note
• https://twitter.com/CveFindCom/status/1993495139466063933 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1993450542920560767 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1p9ah42/resumen_diario_de_vulnerabilidades_29112025 · Reddit Post