GHSA-rpfv-46xj-5984
Upsonic has vulnerability in Pickle Handler component that can lead to deserialization
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6. This issue affects the function cloudpickle.loads of the file /tools/add_tool of the component Pickle Handler. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-6279
- https://github.com/Upsonic/Upsonic/issues/353
- https://github.com/Upsonic/Upsonic/pull/360
- https://github.com/Upsonic/Upsonic/pull/360#issuecomment-2979387098
- https://github.com/Upsonic/Upsonic/commit/a54529acc6e4bfe28f4f5c80c058144348a306b7
- https://github.com/Upsonic/Upsonic
- https://github.com/pypa/advisory-database/tree/main/vulns/upsonic/PYSEC-2025-68.yaml
- https://vuldb.com/?ctiid.313283
- https://vuldb.com/?id.313283
- https://vuldb.com/?submit.593099