GHSA-cq46-m9x9-j8w2 Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization

Q: Which versions are affected by GHSA-cq46-m9x9-j8w2?

2 open source packages ship an affected version, including scapy.

Q: Is GHSA-cq46-m9x9-j8w2 being exploited?

There is no known exploitation of GHSA-cq46-m9x9-j8w2 in the wild and no public exploit code.

Q: How do I fix GHSA-cq46-m9x9-j8w2?

No fix has been published for GHSA-cq46-m9x9-j8w2 yet. Limit exposure of the affected software until one is available.

Not scored Published 22 Oct 2025

Attackers can execute arbitrary code by tricking users into loading malicious Scapy session files via unsafe pickle deserialization.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is GHSA-cq46-m9x9-j8w2?

GHSA-cq46-m9x9-j8w2 is an unsafe deserialization vulnerability in scapy, published on 22 Oct 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Summary

An unsafe deserialization vulnerability in Scapy <v2.7.0 allows attackers to execute arbitrary code when a malicious session file is locally loaded via the -s option. This requires convincing a user to manually load a malicious session file.

Details

Scapy’s interactive shell supports session loading using gzip-compressed pickle files:

./run_scapy -s &lt;session_file.pkl.gz&gt;

Internally, this triggers:

# main.py
SESSION = pickle.load(gzip.open(session_name, &#34;rb&#34;))

Since no validation or restriction is performed on the deserialized object, any code embedded via __reduce__() will be executed immediately. This makes it trivial for an attacker to drop a malicious .pkl.gz in a shared folder and have it executed by unsuspecting users.

The vulnerability exists in the load_session function, which deserializes data using pickle.load() on .pkl.gz files provided via the -s CLI flag or programmatically through conf.session.

Affected lines in source code: https://github.com/secdev/scapy/blob/master/scapy/main.py#L569-L572

try:
    s = pickle.load(gzip.open(fname, &#34;rb&#34;))
except IOError:
    try:
        s = pickle.load(open(fname, &#34;rb&#34;))

Impact

This is a classic deserialization vulnerability which leads to Code Execution (CE) when untrusted data is deserialized.

Any user who can trick another user into loading a crafted .pkl.gz session file (e.g. via -s option) can execute arbitrary Python code.

Vulnerability type: Insecure deserialization (Python pickle)
CWE: CWE-502: Deserialization of Untrusted Data
CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 5.4 (Medium)
Impact: Arbitrary Code Execution
Attack vector: Local or supply chain (malicious .pkl.gz)
Affected users: Any user who loads session files (even interactively)
Affected version: Scapy v2.6.1

Mitigations

Do not use 'sessions' (the -s option when launching Scapy).
Use the Scapy 2.7.0+ where the session mechanism has been removed.

Which versions are affected by GHSA-cq46-m9x9-j8w2?