GHSA-97w9-v595-3h5q

cryptidy allows code execution via untrusted data due to pickle.loads

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-63675

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	cryptidy	<= 1.2.4	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-63675 advisory
https://github.com/javiermorales36/cryptidy-analysis web
https://github.com/netinvent/cryptidy package
https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.py#L220-L238 web