{"id":"CVE-2025-63675","aliases":["EUVD-2025-37311","GHSA-97w9-v595-3h5q","PYSEC-2026-1282"],"status":"published","title":"cryptidy allows code execution via untrusted data due to pickle.loads","description":"cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.","severity":{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00252,"percentile":0.1688,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2025-10-31T00:00:00Z","modified":"2026-10-28T02:30:42Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"cryptidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"cryptidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.4"}]}],"versions":["1.0.5","1.0.7","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4"]},{"source":"osv","ecosystem":"PyPI","package":"cryptidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.4"}]}],"versions":["1.0.5","1.0.7","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4"]}],"products":[{"vendor":"cryptidy","product":"cryptidy"},{"vendor":"netinvent","product":"cryptidy"}],"references":[{"url":"https://github.com/javiermorales36/cryptidy-analysis","tags":["exploit","Exploit","Third Party Advisory","package","web"]},{"url":"https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.py#L220-L238","tags":["Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-63675","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-97w9-v595-3h5q","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/63xxx/CVE-2025-63675.json","tags":["advisory"]},{"url":"https://github.com/netinvent/cryptidy","tags":["package"]},{"url":"https://pypi.org/project/cryptidy","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-63675","description":"cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.","status":"published","published":"2025-10-31T00:00:00Z","modified":"2025-10-31T16:44:37.61Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:32:45.503988Z"}],"euvd":[{"id":"EUVD-2025-37311","description":"cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.","status":"published","published":"2025-10-31T00:00:00Z","modified":"2025-10-31T16:44:37Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:35.368666Z"}],"ghsa":[{"id":"GHSA-97w9-v595-3h5q","title":"cryptidy allows code execution via untrusted data due to pickle.loads ","description":"cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.","status":"published","published":"2025-10-31T09:30:25Z","modified":"2025-10-31T17:56:12Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"nvd":[{"id":"CVE-2025-63675","description":"cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.","status":"published","published":"2025-10-31T07:15:38.283Z","modified":"2026-10-19T22:10:00.13Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:11:41.607433Z"}],"osv":[{"id":"CVE-2025-63675","description":"cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.","status":"published","published":"2025-10-31T00:00:00Z","modified":"2026-10-28T02:30:42.301404961Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:44:51.851511Z"},{"id":"GHSA-97w9-v595-3h5q","title":"cryptidy allows code execution via untrusted data due to pickle.loads ","description":"cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.","status":"published","published":"2025-10-31T09:30:25Z","modified":"2026-07-07T17:57:21.311227474Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"PYSEC-2026-1282","title":"cryptidy allows code execution via untrusted data due to pickle.loads ","description":"cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.","status":"published","published":"2026-07-07T16:03:09.29831Z","modified":"2026-07-07T17:47:34.754256029Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:54.622769Z"}]}}