CVE-2025-56005
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code...
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the picklefile parameter in the yacc() function. This parameter accepts a .pkl file that is deserialized with pickle.load() without validation. Because pickle allows execution of embedded code via __reduce__(), an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the picklefile parameter in the yacc() function. This parameter accepts a .pkl file that is deserialized with pickle.load() without validation. Because pickle allows execution of embedded code via __reduce__(), an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.
- Record
CVE-2025-56005- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502, CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2026-3342
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the picklefile parameter in the yacc() function. This parameter accepts a .pkl file that is deserialized with pickle.load() without validation. Because pickle allows execution of embedded code via __reduce__(), an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.
- Record
EUVD-2026-3342- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qc6m-pwr3-g72p
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code...
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the picklefile parameter in the yacc() function. This parameter accepts a .pkl file that is deserialized with pickle.load() without validation. Because pickle allows execution of embedded code via __reduce__(), an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk.
- Record
GHSA-qc6m-pwr3-g72p- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the picklefile parameter in the yacc() function. This parameter accepts a .pkl file that is deserialized with pickle.load() without validation. Because pickle allows execution of embedded code via __reduce__(), an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.
- Record
CVE-2025-56005- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the picklefile parameter in the yacc() function. This parameter accepts a .pkl file that is deserialized with pickle.load() without validation. Because pickle allows execution of embedded code via __reduce__(), an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.
- Record
CVE-2025-56005- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-56005
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the picklefile parameter in the yacc() function. This parameter accepts a .pkl file that is deserialized with pickle.load() without validation. Because pickle allows execution of embedded code via __reduce__(), an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.
- Record
DEBIAN-CVE-2025-56005- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVOESA-2026-1481
python-ply security update
Security Fix(es):
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the picklefile parameter in the yacc() function. This parameter accepts a .pkl file that is deserialized with pickle.load() without validation. Because pickle allows execution of embedded code via __reduce__(), an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.(CVE-2025-56005)
- Record
OESA-2026-1481- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-1594
python-ply security update
/ply/ /ply--*.egg-info/
Security Fix(es):
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the picklefile parameter in the yacc() function. This parameter accepts a .pkl file that is deserialized with pickle.load() without validation. Because pickle allows execution of embedded code via __reduce__(), an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.(CVE-2025-56005)
- Record
OESA-2026-1594- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-1595
python-ply security update
/ply/ /ply--*.egg-info/
Security Fix(es):
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the picklefile parameter in the yacc() function. This parameter accepts a .pkl file that is deserialized with pickle.load() without validation. Because pickle allows execution of embedded code via __reduce__(), an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.(CVE-2025-56005)
- Record
OESA-2026-1595- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-1596
python-ply security update
/ply/ /ply--*.egg-info/
Security Fix(es):
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the picklefile parameter in the yacc() function. This parameter accepts a .pkl file that is deserialized with pickle.load() without validation. Because pickle allows execution of embedded code via __reduce__(), an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.(CVE-2025-56005)
- Record
OESA-2026-1596- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-1597
python-ply security update
/ply/ /ply--*.egg-info/
Security Fix(es):
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the picklefile parameter in the yacc() function. This parameter accepts a .pkl file that is deserialized with pickle.load() without validation. Because pickle allows execution of embedded code via __reduce__(), an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.(CVE-2025-56005)
- Record
OESA-2026-1597- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-56005
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the picklefile parameter in the yacc() function. This parameter accepts a .pkl file that is deserialized with pickle.load() without validation. Because pickle allows execution of embedded code via __reduce__(), an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.
- Record
UBUNTU-CVE-2025-56005- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2026-0079 No score
Updated python-ply packages fix security vulnerability
Unsafe pickle file handling in Ply. (CVE-2025-56005)
- Record
MGASA-2026-0079- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10418-1 No score
python311-jsonpath-ng-1.8.0-1.1 on GA media
These are all security issues fixed in the python311-jsonpath-ng-1.8.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10418-1- Updated
- 2026-11-02
Affected products
- dabeaz ply
- red hat fence agents remediation operator
- red hat migration toolkit for containers
- red hat migration toolkit for virtualization
- red hat openshift developer tools and services
- red hat openshift pipelines
- red hat openshift service mesh 2
- red hat openshift service mesh 3
- red hat advanced cluster security 4
- red hat ansible automation platform ansible core 2
- red hat ceph storage 7
- red hat ceph storage 8
Show 16 moreShow less
- red hat certification program for red hat enterprise linux 9
- red hat directory server 13
- red hat enterprise linux 10
- red hat enterprise linux 7
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat enterprise linux ai (rhel ai) 3
- red hat openshift container platform 4
- red hat openshift data foundation 4
- red hat openshift gitops
- red hat openstack platform 13 (queens)
- red hat openstack platform 16.2
- red hat openstack platform 17.1
- red hat openstack platform 18.0
- red hat quay 3
- red hat service telemetry framework 1.5
Affected packages
| Package | Affected | Fixed |
|---|---|---|
plyDebian:12 |
All versions, plus listed versions 3.11-103.11-113.11-123.11-53.11-63.11-73.11-83.11-9 |
None known |
plyDebian:13 |
All versions, plus listed versions 3.11-103.11-113.11-123.11-9 |
None known |
plyDebian:14 |
All versions, plus listed versions 3.11-103.11-113.11-123.11-9 |
None known |
python-plyMageia:9 |
before 3.11-8.1.mga9 | 3.11-8.1.mga9 |
python-plyopenEuler:24.03-LTS-SP3 |
before 3.11-4.oe2403sp3 | 3.11-4.oe2403sp3 |
python-plyopenEuler:22.03-LTS-SP4 |
before 3.11-4.oe2203sp4 | 3.11-4.oe2203sp4 |
python-plyopenEuler:24.03-LTS |
before 3.11-4.oe2403 | 3.11-4.oe2403 |
python-plyopenEuler:24.03-LTS-SP1 |
before 3.11-4.oe2403sp1 | 3.11-4.oe2403sp1 |
python-plyopenEuler:24.03-LTS-SP2 |
before 3.11-4.oe2403sp2 | 3.11-4.oe2403sp2 |
plyUbuntu:16.04:LTS |
All versions, plus listed versions 3.7-1 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
plyUbuntu:18.04:LTS |
All versions, plus listed versions 3.9-13.11-1 |
None known |
plyUbuntu:20.04:LTS |
All versions, plus listed versions 3.11-33.11-3build13.11-3ubuntu0.1 |
None known |
plyUbuntu:22.04:LTS |
All versions, plus listed versions 3.11-4ubuntu13.11-5 |
None known |
plyUbuntu:24.04:LTS |
All versions, plus listed versions 3.11-53.11-6 |
None known |
plyUbuntu:25.10 |
All versions, plus listed versions 3.11-9 |
None known |
python-jsonpath-ngopenSUSE:Tumbleweed |
before 1.8.0-1.1 | 1.8.0-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | gdfurr98/ply-cve-2025-56005-lab | 2026-09-27 |
| PoC in GitHub | gdfurr98/ply-safepickle | 2026-09-27 |
| PoC in GitHub | tom025/ply_exploit_rejection | 2026-01-27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-56005 is a critical vulnerability (CVSS 9.8) in Dabeaz Ply, published January 20, 2026. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.8%, the 97th percentile. Fixed in python-ply 3.11-8.1.mga9.
References
github.com/bohmiiidd/Undocumented-RCE-in-PLY
openwall.com/lists/oss-security/2026/01/23/4
Show 22 moreShow less
access.redhat.com/security/cve/CVE-2025-56005
bugzilla.redhat.com/show_bug.cgi?id=2431308
security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-56005.json
nvd.nist.gov/vuln/detail/CVE-2025-56005
security-tracker.debian.org/tracker/CVE-2025-56005
advisories.mageia.org/MGASA-2026-0079.html
bugs.mageia.org/show_bug.cgi?id=35294
lists.fedoraproject.org/archives/list/[email protected]/message/DHEPCPZY7AYJOCFYA65AKYXVQ5H5GOMT
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-1481
ubuntu.com/security/CVE-2025-56005
cve.org/CVERecord?id=CVE-2025-56005
suse.com/security/cve/CVE-2025-56005