CVE-2025-13428 RCE in SecOps SOAR server via user-provided Python packages
Authenticated users with IDE role can achieve remote code execution by uploading malicious Python packages to the SecOps SOAR server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-13428?
CVE-2025-13428 is a high-severity code injection vulnerability in Google Cloud SecOps SOAR, published on 9 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability exists in the SecOps SOAR server. The custom integrations feature allowed an authenticated user with an "IDE role" to achieve Remote Code Execution (RCE) in the server. The flaw stemmed from weak validation of uploaded Python package code. An attacker could upload a package containing a malicious setup.py file, which would execute on the server during the installation process, leading to potential server compromise.
No customer action is required.
All customers have been automatically upgraded to the fixed version: 6.3.64 or higher.
Weakness: CWE-20
Which versions are affected by CVE-2025-13428?
It affects 1 product.
Products include Google Security Operations Soar.
How do I fix CVE-2025-13428?
No fix has been published for CVE-2025-13428 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-13428 being exploited?
There is no known exploitation of CVE-2025-13428 in the wild and no public exploit code.
Sources
Also known as GHSA-7cf3-6632-g938.