python-socketio
CVE-2025-61765
MEDIUM
Severity by source
AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Attacker needs prior access to the internal/private message queue, so AV:A and PR:H; successful pickle RCE yields full process compromise, hence C:H/I:H/A:H.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
1DescriptionCVE.org
python-socketio is a Python implementation of the Socket.IO realtime client and server. A remote code execution vulnerability in python-socketio versions prior to 5.14.0 allows attackers to execute arbitrary Python code through malicious pickle deserialization in multi-server deployments on which the attacker previously gained access to the message queue that the servers use for internal communications. When Socket.IO servers are configured to use a message queue backend such as Redis for inter-server communication, messages sent between the servers are encoded using the pickle Python module. When a server receives one of these messages through the message queue, it assumes it is trusted and immediately deserializes it. The vulnerability stems from deserialization of messages using Python's pickle.loads() function. Having previously obtained access to the message queue, the attacker can send a python-socketio server a crafted pickle payload that executes arbitrary code during deserialization via Python's __reduce__ method. This vulnerability only affects deployments with a compromised message queue. The attack can lead to the attacker executing random code in the context of, and with the privileges of a Socket.IO server process. Single-server systems that do not use a message queue, and multi-server systems with a secure message queue are not vulnerable. In addition to making sure standard security practices are followed in the deployment of the message queue, users of the python-socketio package can upgrade to version 5.14.0 or newer, which remove the pickle module and use the much safer JSON encoding for inter-server messaging.
AnalysisAI
Arbitrary Python code execution in python-socketio versions 0.8.0 through 5.13.x is achievable when a multi-server deployment uses a pickle-based message-queue backend (Redis via the redis_manager/async_redis_manager, Kafka, RabbitMQ via aiopika, or Kombu) because each node deserializes inter-server messages with pickle.loads() without validating their origin. The attack is conditional rather than opportunistic: the adversary must have already obtained write/publish access to the internal message queue, from which they can drop a crafted payload that executes with the full privileges of the Socket.IO server process. No public exploit identified at time of analysis, EPSS is low at 0.48% (40th percentile), and CISA KEV does not list this issue; the vendor fix is version 5.14.0, which removes pickle entirely in favor of JSON encoding.
Technical ContextAI
The root cause is CWE-502, deserialization of untrusted data, occurring in python-socketio's pub/sub manager layer that coordinates state across horizontally scaled Socket.IO servers. In affected releases, the managers (redis_manager.py, async_redis_manager.py, kafka_manager.py, kombu_manager.py, async_aiopika_manager.py, and the shared pubsub_manager.py/async_pubsub_manager.py threads) serialize inter-node messages with pickle.dumps() on publish and call pickle.loads() on receive, treating anything arriving on the internal channel as implicitly trusted. Python's pickle format is not a data-only format: it can carry callable reconstruction instructions, and an attacker-supplied payload using __reduce__ causes arbitrary code to run at load time, before any application-level validation can inspect the message. The commit at 53f6be094257ed81476b0e212c8cddd6d06ca39a removes the pickle import from each manager and switches both the publish and listen paths to engineio's JSON codec, which cannot express executable constructs; the same commit tightens the deployment documentation to state that a single-node queue should bind only to localhost and that multi-node queues should be placed on a private network/VPC with authentication and encryption. Affected CPE/package coordinates are pip/python-socketio from 0.8.0 up to but excluding 5.14.0. The supplied CVSS vector (AV:A/PR:H) correctly reflects that the attacker must already be positioned on the internal network segment hosting the queue and must already possess queue credentials - this is a post-compromise escalation primitive, not a remotely reachable pre-auth flaw.
Affected ProductsAI
python-socketio (pip package python-socketio) versions greater than or equal to 0.8.0 and earlier than 5.14.0 are affected, per the GitHub advisory GHSA-g8c6-8fjj-2r4m and the upstream commit. The vulnerability manifests only on deployments that instantiate a message-queue-backed manager: the Redis manager (redis_manager / async_redis_manager), the Kafka manager (kafka_manager), the RabbitMQ aio-pika manager (async_aiopika_manager), and the Kombu manager (kombu_manager) all passed data through pickle.dumps/pickle.loads and are all changed by the fix. The shared pubsub and async_pubsub manager base classes also carried the vulnerable pickle.loads fallback path. Single-server deployments that use the default in-process manager with no message queue, and multi-server deployments whose queue is authenticated, encrypted and network-isolated, are explicitly out of scope for exploitation. Refer to the vendor advisory at https://github.com/miguelgrinberg/python-socketio/security/advisories/GHSA-g8c6-8fjj-2r4m and the Bluerock write-up at https://www.bluerock.io/post/cve-2025-61765-bluerock-discovers-critical-rce-in-socket-io-ecosystem for product and deployment context.
RemediationAI
Vendor-released patch: upgrade python-socketio to 5.14.0 or newer, which eliminates pickle from inter-server messaging and replaces it with engineio's JSON codec, so a hostile queue message can no longer trigger code execution during deserialization (see https://github.com/miguelgrinberg/python-socketio/security/advisories/GHSA-g8c6-8fjj-2r4m and the fix commit https://github.com/miguelgrinberg/python-socketio/commit/53f6be094257ed81476b0e212c8cddd6d06ca39a). Where upgrading must be deferred, the practical compensating controls are those that deny the attacker the queue access the exploit depends on: bind a single-node queue to localhost only, and for multi-node deployments place the message queue on a private network/VPC with no route from untrusted segments; enable and enforce queue authentication and TLS encryption so credentials are required and traffic cannot be sniffed or spoofed; and restrict firewall/security-group rules so only the Socket.IO server hosts can reach the queue port (Redis 6379, Kafka 9092, RabbitMQ 5672/amqps), accepting that this reduces but does not remove risk if any server host is itself compromised, since an attacker who already holds queue write access can still publish a malicious pickle to a patched-but-unupgraded peer. Note that these are perimeter controls with a shared trust boundary trade-off: they do not change the fact that pre-5.14.0 peers will blindly unpickle whatever reaches them, so upgrading remains the only complete fix. Also rotate any credentials for the message queue, since the exploit prerequisite implies those credentials or the queue itself were already compromised.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today