PT-2026-6657 · Epyt-Flow · Epyt-Flow

Syphonetic

·

Published

2026-02-04

·

Updated

2026-02-07

·

CVE-2026-25632

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions EPyT-Flow versions prior to 0.16.1
Description EPyT-Flow is a Python package used for generating hydraulic and water quality scenario data for water distribution networks. The REST API parses attacker-controlled JSON request bodies using a custom deserializer, my load from json, which supports a type field. When this field is present, the deserializer dynamically imports and instantiates a module/class specified by the attacker, with arguments also supplied by the attacker. This allows the invocation of dangerous classes like subprocess.Popen, potentially leading to operating system command execution during JSON parsing. This issue also affects the loading of JSON files. The type field is used in the deserialization process.
Recommendations Versions prior to 0.16.1 should be updated to version 0.16.1. Do not load JSON data from untrusted sources. Do not expose the REST API.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-25632
GHSA-74VM-8FRP-7W68

Affected Products

Epyt-Flow