CVE-2025-58367
CVE-2025-58367 is a critical-severity vulnerability with a CVSS 4.0 base score of 10.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-915.
Key facts
- Severity: Critical (CVSS 4.0 base score 10.0)
- EPSS exploit prediction: 1% (60th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-27049
- Weakness: CWE-915
- Published:
- Last modified:
Description
DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are vulnerable to class pollution via the Delta class constructor, and when combined with a gadget available in DeltaDiff, it can lead to Denial of Service and Remote Code Execution (via insecure Pickle deserialization) exploitation. The gadget available in DeepDiff allows `deepdiff.serialization.SAFE_TO_IMPORT` to be modified to allow dangerous classes such as posix.system, and then perform insecure Pickle deserialization via the Delta class. This potentially allows any Python code to be executed, given that the input to Delta is user-controlled. Depending on the application where DeepDiff is used, this can also lead to other vulnerabilities. This is fixed in version 8.6.1.
Frequently asked questions
- What is CVE-2025-58367?
- DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are vulnerable to class pollution via the Delta class constructor, and when combined with a gadget available in DeltaDiff, it can lead to Denial of Service and Remote Code Execution (via insecure Pickle deserialization) exploitation. The gadget available in DeepDiff allows `deepdiff.serialization.SAFE_TO_IMPORT` to be modified to allow dangerous classes such as posix.system, and then perform insecure Pickle deserialization via the Delta class. This potentially allows any Python code to be executed, given that the input to Delta is user-controlled. Depending on the application where DeepDiff is used, this can also lead to other vulnerabilities. This is fixed in version 8.6.1.
- How severe is CVE-2025-58367?
- CVE-2025-58367 has a CVSS 4.0 base score of 10.0, rated critical severity.
- Is CVE-2025-58367 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (60th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2025-58367?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- Does CVE-2025-58367 have an EU (EUVD) identifier?
- Yes. CVE-2025-58367 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-27049.
- When was CVE-2025-58367 published?
- CVE-2025-58367 was published on 2025-09-05 and last updated on 2026-06-17.
References
- https://github.com/seperman/deepdiff/commit/c69c06c13f75e849c770ade3f556cd16209fd183
- https://github.com/seperman/deepdiff/releases/tag/8.6.1
- https://github.com/seperman/deepdiff/security/advisories/GHSA-mw26-5g2v-hqw3
Other CWE-915 vulnerabilities
- CVE-2026-50160 — Critical (CVSS 10.0): Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and…
- CVE-2026-33453 — Critical (CVSS 10.0): Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap…
- CVE-2026-56142 — Critical (CVSS 9.9): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429…
- CVE-2025-2304 — Critical (CVSS 9.4): A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the…
- CVE-2025-24370 — Critical (CVSS 9.3): Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn…
- CVE-2026-34179 — Critical (CVSS 9.1): In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate…