Which versions of Upsonic are affected by CVE-2025-6279?

Organizations using Upsonic should be aware of moderate risk from CVE-2025-6279, a input validation vulnerability rated CVSS 5.5. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2025-6279?

Yes, a public proof-of-concept exploit is available for CVE-2025-6279. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6279?

Within 30 days: Identify affected systems running Upsonic and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Upsonic CVE-2025-6279

Q: What is the CVSS score of CVE-2025-6279?

CVE-2025-6279 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18696 LOW

Improper Input Validation (CWE-20)

2025-06-19 cna@vuldb.com

GHSA-rpfv-46xj-5984

Deserialization Upsonic

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Adjacent network, low privileges, low impact.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 26, 2026 - 13:24 vuln.today

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.5 (MEDIUM) 2.0 (LOW)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 00:08 euvd

EUVD-2025-18696

Analysis Generated

Mar 15, 2026 - 00:08 vuln.today

PoC Detected

Jul 08, 2025 - 16:36 vuln.today

Public exploit code

CVE Published

Jun 19, 2025 - 21:15 cve.org

LOW 2.0

CVE Published

Jun 19, 2025 - 21:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6. This issue affects the function cloudpickle.loads of the file /tools/add_tool of the component Pickle Handler. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used.

AnalysisAI

Deserialization vulnerability in Upsonic up to 0.55.6 allows remote authenticated attackers to execute arbitrary code via the Pickle Handler in /tools/add_tool. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.07%), indicating limited exploitation likelihood.

Technical ContextAI

The vulnerability is a deserialization flaw (CWE-20: Improper Input Validation) in the cloudpickle.loads function used by the Pickle Handler component. Cloudpickle is a Python library for serializing complex objects; insecure deserialization of untrusted data can lead to arbitrary code execution. The affected product is Upsonic, an AI agent framework, with CPE cpe:2.3:a:upsonic:upsonic:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to the patched version provided by the vendor. The fix is available in commit a54529acc6e4bfe28f4f5c80c058144348a306b7 and pull request #360. As a workaround, restrict access to the /tools/add_tool endpoint to trusted users only, or disable the Pickle Handler if not required.