Which versions of Upsonic are affected by EUVD-2025-18696?

Organizations using Upsonic should be aware of moderate risk from CVE-2025-6279, a input validation vulnerability rated CVSS 5.5. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for EUVD-2025-18696?

Yes, a public proof-of-concept exploit is available for EUVD-2025-18696. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-18696?

Within 30 days: Identify affected systems running Upsonic and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Upsonic EUVD-2025-18696

Q: What is the CVSS score of EUVD-2025-18696?

EUVD-2025-18696 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-6279 LOW

Improper Input Validation (CWE-20)

2025-06-19 cna@vuldb.com

GHSA-rpfv-46xj-5984

Deserialization Upsonic

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Adjacent network, low privileges, low impact.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 26, 2026 - 13:24 vuln.today

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.5 (MEDIUM) 2.0 (LOW)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 00:08 euvd

EUVD-2025-18696

Analysis Generated

Mar 15, 2026 - 00:08 vuln.today

PoC Detected

Jul 08, 2025 - 16:36 vuln.today

Public exploit code

CVE Published

Jun 19, 2025 - 21:15 cve.org

LOW 2.0

CVE Published

Jun 19, 2025 - 21:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6. This issue affects the function cloudpickle.loads of the file /tools/add_tool of the component Pickle Handler. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used.

AnalysisAI

Deserialization vulnerability in Upsonic up to 0.55.6 allows remote authenticated attackers to execute arbitrary code via the Pickle Handler in /tools/add_tool. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.07%), indicating limited exploitation likelihood.

Technical ContextAI

The vulnerability is a deserialization flaw (CWE-20: Improper Input Validation) in the cloudpickle.loads function used by the Pickle Handler component. Cloudpickle is a Python library for serializing complex objects; insecure deserialization of untrusted data can lead to arbitrary code execution. The affected product is Upsonic, an AI agent framework, with CPE cpe:2.3:a:upsonic:upsonic:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to the patched version provided by the vendor. The fix is available in commit a54529acc6e4bfe28f4f5c80c058144348a306b7 and pull request #360. As a workaround, restrict access to the /tools/add_tool endpoint to trusted users only, or disable the Pickle Handler if not required.