pyquokka CVE-2025-62515
CRITICALSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable Flight endpoint deserializes untrusted pickle with no auth or user interaction (AV:N/AC:L/PR:N/UI:N), yielding full code execution and thus total C/I/A impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
pyquokka is a framework for making data lakes work for time series. In versions 0.3.1 and prior, the FlightServer class directly uses pickle.loads() to deserialize action bodies received from Flight clients without any sanitization or validation in the do_action() method. The vulnerable code is located in pyquokka/flight.py at line 283 where arbitrary data from Flight clients is directly passed to pickle.loads(). When FlightServer is configured to listen on 0.0.0.0, this allows attackers across the entire network to perform arbitrary remote code execution by sending malicious pickled payloads through the set_configs action. Additional vulnerability points exist in the cache_garbage_collect, do_put, and do_get functions where pickle.loads is used to deserialize untrusted remote data.
AnalysisAI
Remote code execution in pyquokka 0.3.1 and prior allows unauthenticated remote attackers to execute arbitrary commands on a host running a network-exposed FlightServer. The FlightServer.do_action() method at pyquokka/flight.py line 283 passes client-supplied action bodies directly to pickle.loads(), so a crafted set_configs action can trigger command execution; similar unsafe pickle.loads() use exists in cache_garbage_collect, do_put, and do_get. Publicly available exploit code exists, and the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8); the primary prerequisite is a reachable FlightServer bound to a non-local interface such as 0.0.0.0, and no application-level authentication gates the endpoint.
Technical ContextAI
pyquokka is a time-series/data-lake framework that uses Apache Arrow Flight over gRPC for client-server actions. In the affected FlightServer class, action bodies from Flight clients are treated as trusted data and passed to Python pickle.loads() without sanitization or validation; this is CWE-502 deserialization of untrusted data. Python pickle can invoke arbitrary __reduce__ callables during deserialization, so attacker-controlled bytes can execute OS commands. The advisory identifies the primary sink at pyquokka/flight.py line 283 in do_action(), and also flags the cache_garbage_collect, do_put, and do_get functions as additional pickle.loads() vulnerability points. The affected package is reported as pip/pyquokka <= 0.3.1; no CPE strings were provided, but the vendor advisory and package metadata identify pyquokka as the product and pyquokka/flight.py as the vulnerable code.
Affected ProductsAI
pyquokka versions 0.3.1 and prior are affected (pip package pyquokka, reported vulnerable <= 0.3.1). The vulnerable component is the FlightServer class in pyquokka/flight.py, specifically do_action() at line 283 and the cache_garbage_collect, do_put, and do_get functions. The advisory's server example binds to 0.0.0.0 with location grpc+tcp://0.0.0.0:5005, exposing the gRPC/Flight endpoint. The source reports fixed in: None, and no CPE string was supplied; vendor advisory: https://github.com/marsupialtail/quokka/security/advisories/GHSA-f74j-gffq-vm9p.
RemediationAI
No vendor-released patch identified at time of analysis (reported fixed in: None). Until an update is available, do not expose pyquokka FlightServer to untrusted networks: bind it to 127.0.0.1, localhost, or a Unix domain socket instead of 0.0.0.0, and restrict the gRPC/Flight port (example 5005) with host firewall rules or network ACLs so only trusted clients can connect. The trade-off is that legitimate remote Flight clients will lose access unless they are on the same trusted host or network; localhost-only binding prevents remote exploitation but also blocks distributed workloads. If network exposure is required, place the endpoint behind a gRPC-aware authenticated proxy or VPN, since the application itself provides no authentication on the vulnerable actions; this adds infrastructure and may not cover raw gRPC semantics. For code-level mitigation, replace pickle.loads() on untrusted action bodies with a safe serialization format or strict allow-listing, and fix all affected functions (do_action, cache_garbage_collect, do_put, do_get), but this requires maintaining a fork or upstream fix. Monitor the GitHub advisory GHSA-f74j-gffq-vm9p for patched versions.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today