{"answers":{"affected":"3 open source packages ship an affected version, including deepdiff.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-58367 exists.","fix":"Upgrade deepdiff to 8.6.1 or later.","what":"CVE-2025-58367 is a critical unsafe deserialization vulnerability in seperman deepdiff, published on 5 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-58367 and fix it if it is affected.\n\nWhat it is: CVE-2025-58367 is a critical unsafe deserialization vulnerability in seperman deepdiff, published on 5 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-58367 exists.\n\nAffected packages and fixed versions:\n- deepdiff (PyPI): affected from 5.0.0; fixed in 8.6.1\n- deepdiff (PyPI): affected from 5.0.0; fixed in 8.6.1\n- deepdiff (PyPI): affected from 5.0.0; fixed in 8.6.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-58367/ (Markdown: https://insights.sbomify.com/CVE-2025-58367/index.md)","id":"CVE-2025-58367","markdown":"https://insights.sbomify.com/CVE-2025-58367/index.md","name":"CVE-2025-58367","record":{"aliases":["CLSA-2025-1757981510","DEBIAN-CVE-2025-58367","GHSA-mw26-5g2v-hqw3","MINI-wwjv-xv2w-qj4r","PYSEC-2026-327","SUSE-SU-2025:03127-1","UBUNTU-CVE-2025-58367","openSUSE-SU-2025:15536-1"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Python data comparison library","requires_auth":"none","summary":"Attackers can achieve remote code execution and denial of service by exploiting insecure Pickle deserialization in the Delta class constructor.","user_interaction":"not_required","vuln_class":"deserialization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":10,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0"},"cwes":[{"id":"CWE-915","name":"Improperly Controlled Modification of Dynamically-Determined Object Attributes"}],"description":"DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are vulnerable to class pollution via the Delta class constructor, and when combined with a gadget available in DeltaDiff, it can lead to Denial of Service and Remote Code Execution (via insecure Pickle deserialization) exploitation. The gadget available in DeepDiff allows `deepdiff.serialization.SAFE_TO_IMPORT` to be modified to allow dangerous classes such as posix.system, and then perform insecure Pickle deserialization via the Delta class. This potentially allows any Python code to be executed, given that the input to Delta is user-controlled. Depending on the application where DeepDiff is used, this can also lead to other vulnerabilities. This is fixed in version 8.6.1.","ecosystems":["PyPI","openSUSE:Leap 15.6","openSUSE:Tumbleweed"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"DeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollution","id":"CVE-2025-58367","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"deserialization","year":"2025"},"n_packages":5,"n_references":3,"next":{"headline":"fs2: Half-shutdown of socket during TLS handshake may result in spin loop on opposite side","id":"CVE-2025-58369"},"packages":[{"ecosystem":"PyPI","fixed":["8.6.1"],"introduced":["5.0.0"],"last_affected":[],"package":"deepdiff","purl":null,"source":"GHSA-mw26-5g2v-hqw3"},{"ecosystem":"PyPI","fixed":["8.6.1"],"introduced":["5.0.0"],"last_affected":[],"package":"deepdiff","purl":"pkg:pypi/deepdiff","source":"GHSA-mw26-5g2v-hqw3"},{"ecosystem":"PyPI","fixed":["8.6.1"],"introduced":["5.0.0"],"last_affected":[],"package":"deepdiff","purl":"pkg:pypi/deepdiff","source":"PYSEC-2026-327"},{"ecosystem":"openSUSE:Leap 15.6","fixed":["6.3.0-150600.3.3.1"],"introduced":["0"],"last_affected":[],"package":"python-deepdiff","purl":"pkg:rpm/opensuse/python-deepdiff\u0026distro=openSUSE%20Leap%2015.6","source":"SUSE-SU-2025:03127-1"},{"ecosystem":"openSUSE:Tumbleweed","fixed":["8.6.1-1.1"],"introduced":["0"],"last_affected":[],"package":"python-deepdiff","purl":"pkg:rpm/opensuse/python-deepdiff\u0026distro=openSUSE%20Tumbleweed","source":"openSUSE-SU-2025:15536-1"}],"prev":{"headline":"Onyxia private helm repository credentials are leaked through unauthenticated API","id":"CVE-2025-58366"},"products":["deepdiff"],"published":"2025-09-05","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"SUSE"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-09-08","vendors":["seperman"]},"summary":"Attackers can achieve remote code execution and denial of service by exploiting insecure Pickle deserialization in the Delta class constructor.","url":"https://insights.sbomify.com/CVE-2025-58367/"}