GitHub Advisoryadvisory · PyPI

GHSA-97w9-v595-3h5q cryptidy allows code execution via untrusted data due to pickle.loads

MEDIUM Published 2025-10-31 Modified 2025-10-31 Official page ↗
Aliases
CVE-2025-63675
Ecosystem
PyPI
Packages
cryptidy
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-502
Reviewed
2025-10-31

Affected packages

• PyPI cryptidy: <= 1.2.4 (no fix yet)

Description

cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.

Related

Alias · CVE (1)

  • CVE-2025-63675 cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References