GitHub Advisoryadvisory · PyPI

GHSA-74vm-8frp-7w68 EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)

CRITICAL Published 2026-02-04 Modified 2026-10-27 Official page ↗
Aliases
CVE-2026-25632
Ecosystem
PyPI
Packages
epyt-flow
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2026-02-04

Affected packages

• PyPI epyt-flow: < 0.16.1 → fixed in 0.16.1

Description

Impact EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a __type__ field. When __type__ is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files. Patches EPyT-Flow has been patched in 0.16.1 -- affects all versions <= 0.16.0 Workarounds Do not load any JSON from untrusted sources and do not expose the REST API. Credits EPyT-Flow thanks Jarrett Chan (@syphonetic) for detecting and reporting the bug.

Related

Alias · CVE (1)

  • CVE-2026-25632 EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References