What’s Vulnerable › Vulnerabilities

CVE-2025-63675

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-10-31 · updated 2026-10-19
• Weakness: CWE-502

Description

cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.

Affected products

• cryptidy: through 1.2.4

References

• https://github.com/javiermorales36/cryptidy-analysis
• https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.py#L220-L238
• https://github.com/javiermorales36/cryptidy-analysis

Get alerted when CVE-2025-63675 or the next vulnerability affects your stack