Live › vulnerability › CVE-2026-25632
Go to dashboardEPyT-Flow's REST API and JSON file loader build objects from a __type__ field, importing an attacker-named class and passing attacker-supplied arguments. Sending a crafted JSON body can instantiate dangerous classes such as subprocess.Popen and run OS commands on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:25 UTC, 0h before NVD. All times on this page are UTC.
Any deployment running EPyT-Flow version 0.16.0 or earlier that exposes its REST API or loads JSON files from sources it does not control is exposed. Teams using EPyT-Flow only locally with trusted inputs and no network-exposed API face much less risk, but should still upgrade.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| epyt-flow | pypi | < 0.16.1 | 0.16.1 |
| waterfutures epyt-flow | vendor | < 0.16.1 | 0.16.1 |
pip show epyt-flow to read the installed version; affected if below 0.16.1epyt-flow package to 0.16.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files.
EPyT-Flow has been patched in 0.16.1 -- affects all versions <= 0.16.0
Do not load any JSON from untrusted sources and do not expose the REST API.
EPyT-Flow thanks Jarrett Chan (@syphonetic) for detecting and reporting the bug.
This page as .md · .json · in your agent: get_signal("CVE-2026-25632")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.