---
id: "CVE-2026-25632"
kind: "vulnerability"
aliases: ["CVE-2026-25632", "GHSA-74vm-8frp-7w68"]
title: "EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)"
severity: "critical"
cvss: 10.0
epss: 0.00807
exploited: false
status: "open"
category: "package"
products: [{"name": "epyt-flow", "fixed": ["0.16.1"], "affected": "< 0.16.1", "ecosystem": "pypi"}, {"name": "waterfutures epyt-flow", "fixed": ["0.16.1"], "affected": "< 0.16.1", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["cwe-502", "epyt-flow", "package", "pypi", "python", "rest-api"]
not_affected_if: ["no-rest-api-exposed", "trusted-json-only", "version-0.16.1-or-later"]
published_at: "2026-02-04T20:34:28+00:00"
first_seen_at: "2026-10-27T16:25:42+00:00"
updated_at: "2026-10-27T16:33:07+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-74vm-8frp-7w68", "first_seen_at": "2026-10-27T16:25:42+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25632", "first_seen_at": "2026-10-27T16:33:07+00:00"}]
---

# EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)

EPyT-Flow's REST API and JSON file loader build objects from a __type__ field, importing an attacker-named class and passing attacker-supplied arguments. Sending a crafted JSON body can instantiate dangerous classes such as subprocess.Popen and run OS commands on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:epyt-flow affected < 0.16.1 fixed 0.16.1
- vendor:waterfutures epyt-flow affected < 0.16.1 fixed 0.16.1

## How to check

- `pip show epyt-flow` to read the installed version; affected if below `0.16.1`
- Check whether the REST API of EPyT-Flow is reachable from untrusted networks or whether the app loads JSON files from untrusted sources

## Fix

- Upgrade the `epyt-flow` package to `0.16.1` or later
- Until patched, do not load JSON from untrusted sources and do not expose the REST API

## Timeline

- 2026-10-27T16:25:42+00:00 ghsa https://github.com/advisories/GHSA-74vm-8frp-7w68
- 2026-10-27T16:33:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-25632

## From the sources

### Impact
EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a __type__ field. When __type__ is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files.

### Patches
EPyT-Flow  has been patched in 0.16.1 -- affects all versions <= 0.16.0

### Workarounds
Do not load any JSON from untrusted sources and do not expose the REST API.

### Credits
EPyT-Flow  thanks Jarrett Chan (@syphonetic) for detecting and reporting the bug.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_