What is the CVSS score of CVE-2026-25632?

CVE-2026-25632 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-25632?

A critical remote code execution vulnerability in EPyT-Flow allows unauthenticated attackers to execute arbitrary code on systems running the affected package through malicious JSON requests.. A patch is available.

How to fix or mitigate CVE-2026-25632?

Within 24 hours: Identify all systems running EPyT-Flow and isolate them from production networks if possible; disable REST API access or restrict to trusted networks only. Within 7 days: Implement network-level controls (WAF rules, API gateway restrictions) to block suspicious JSON type parameters; begin evaluation of alternative packages or version freezing strategy. Within 30 days: Develop and test a comprehensive remediation plan including potential system migration; establish vendor communication protocol to track patch availability.

Python CVE-2026-25632

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-02-06 security-advisories@github.com

GHSA-74vm-8frp-7w68

Python Command Injection Deserialization Epyt Flow

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 06, 2026 - 21:16 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files. This vulnerability is fixed in 0.16.1.

AnalysisAI

EPyT-Flow hydraulic simulation package has a CVSS 10.0 insecure deserialization enabling code execution when loading simulation scenario files.

Technical ContextAI

EPyT-Flow, a Python package for hydraulic and water quality scenario generation, uses unsafe deserialization (CWE-502) when loading scenario files, allowing code execution through crafted pickle payloads.