{"answers":{"affected":"3 open source packages ship an affected version, including python-socketio.","exploited":"There is no known exploitation of CVE-2025-61765 in the wild and no public exploit code.","fix":"Upgrade python-socketio to 5.14.0 or later.","what":"CVE-2025-61765 is a medium-severity unsafe deserialization vulnerability in miguelgrinberg python-socketio, published on 6 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-61765 and fix it if it is affected.\n\nWhat it is: CVE-2025-61765 is a medium-severity unsafe deserialization vulnerability in miguelgrinberg python-socketio, published on 6 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-61765 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- python-socketio (PyPI): affected from 0.8.0; fixed in 5.14.0\n- python-socketio (PyPI): affected from 0.8.0; fixed in 5.14.0\n- python-socketio (PyPI): affected from 0.8.0; fixed in 5.14.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-61765/ (Markdown: https://insights.sbomify.com/CVE-2025-61765/index.md)","id":"CVE-2025-61765","markdown":"https://insights.sbomify.com/CVE-2025-61765/index.md","name":"CVE-2025-61765","record":{"aliases":["DEBIAN-CVE-2025-61765","GHSA-g8c6-8fjj-2r4m","PYSEC-2026-1854","SUSE-SU-2025:3780-1","UBUNTU-CVE-2025-61765","openSUSE-SU-2025:15613-1"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Python Socket.IO library","requires_auth":"high_privilege","summary":"Attackers with message queue access can execute arbitrary code via unsafe pickle deserialization in multi-server python-socketio deployments.","user_interaction":"not_required","vuln_class":"deserialization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.4,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"description":"python-socketio is a Python implementation of the Socket.IO realtime client and server. A remote code execution vulnerability in python-socketio versions prior to 5.14.0 allows attackers to execute arbitrary Python code through malicious pickle deserialization in multi-server deployments on which the attacker previously gained access to the message queue that the servers use for internal communications. When Socket.IO servers are configured to use a message queue backend such as Redis for inter-server communication, messages sent between the servers are encoded using the `pickle` Python module. When a server receives one of these messages through the message queue, it assumes it is trusted and immediately deserializes it. The vulnerability stems from deserialization of messages using Python's `pickle.loads()` function. Having previously obtained access to the message queue, the attacker can send a python-socketio server a crafted pickle payload that executes arbitrary code during deserialization via Python's `__reduce__` method. This vulnerability only affects deployments with a compromised message queue. The attack can lead to the attacker executing random code in the context of, and with the privileges of a Socket.IO server process. Single-server systems that do not use a message queue, and multi-server systems with a secure message queue are not vulnerable. In addition to making sure standard security practices are followed in the deployment of the message queue, users of the python-socketio package can upgrade to version 5.14.0 or newer, which remove the `pickle` module and use the much safer JSON encoding for inter-server messaging.","ecosystems":["PyPI","SUSE:Linux Enterprise Module for Python 3 15 SP6","SUSE:Linux Enterprise Module for Python 3 15 SP7","openSUSE:Leap 15.6","openSUSE:Tumbleweed"],"exploits":{"exploitdb":0,"first_seen":"2025-10-17","github_poc":1,"max_poc_stars":1,"metasploit":0,"nuclei":0,"refs":[{"date":"2025-10-17T08:02:32Z","kind":"github_poc","ref":"https://github.com/locus-x64/CVE-2025-61765_PoC","stars":1,"title":"Proof of Concept of an unsafe pickle deserialization vulnerability in Socket.IO"}],"tier":"poc_unverified"},"has_fix":true,"headline":"python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments","id":"CVE-2025-61765","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"deserialization","year":"2025"},"n_packages":7,"n_references":3,"next":{"headline":"Bucket vulnerable to infinite recursion when querying a bucket using the != operator","id":"CVE-2025-61766"},"packages":[{"ecosystem":"PyPI","fixed":["5.14.0"],"introduced":["0.8.0"],"last_affected":[],"package":"python-socketio","purl":null,"source":"GHSA-g8c6-8fjj-2r4m"},{"ecosystem":"PyPI","fixed":["5.14.0"],"introduced":["0.8.0"],"last_affected":[],"package":"python-socketio","purl":"pkg:pypi/python-socketio","source":"GHSA-g8c6-8fjj-2r4m"},{"ecosystem":"PyPI","fixed":["5.14.0"],"introduced":["0.8.0"],"last_affected":[],"package":"python-socketio","purl":"pkg:pypi/python-socketio","source":"PYSEC-2026-1854"},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","fixed":["5.7.2-150600.3.3.1"],"introduced":["0"],"last_affected":[],"package":"python-python-socketio","purl":"pkg:rpm/suse/python-python-socketio\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%203%2015%20SP6","source":"SUSE-SU-2025:3780-1"},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","fixed":["5.7.2-150600.3.3.1"],"introduced":["0"],"last_affected":[],"package":"python-python-socketio","purl":"pkg:rpm/suse/python-python-socketio\u0026distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%203%2015%20SP7","source":"SUSE-SU-2025:3780-1"},{"ecosystem":"openSUSE:Leap 15.6","fixed":["5.7.2-150600.3.3.1"],"introduced":["0"],"last_affected":[],"package":"python-python-socketio","purl":"pkg:rpm/opensuse/python-python-socketio\u0026distro=openSUSE%20Leap%2015.6","source":"SUSE-SU-2025:3780-1"},{"ecosystem":"openSUSE:Tumbleweed","fixed":["5.14.1-1.1"],"introduced":["0"],"last_affected":[],"package":"python-python-socketio","purl":"pkg:rpm/opensuse/python-python-socketio\u0026distro=openSUSE%20Tumbleweed","source":"openSUSE-SU-2025:15613-1"}],"prev":{"headline":"Information disclosure in Oracle WebLogic Server","id":"CVE-2025-61764"},"products":["python-socketio"],"published":"2025-10-06","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"SUSE"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-10-22","vendors":["miguelgrinberg"]},"summary":"Attackers with message queue access can execute arbitrary code via unsafe pickle deserialization in multi-server python-socketio deployments.","url":"https://insights.sbomify.com/CVE-2025-61765/"}