Critical · published October 1, 2025
🚨 A crafty data stream is all it takes to execute code remotely! In versions 0.12.0 to 0.12.2 of pyfory, untrusted serialized data can lead to absolute chaos! 🔥 Think of it as a chef who blindly follows an incorrect recipe without checking the ingredients. If that recipe calls for something dangerous, the results can be disastrous! An attacker could potentially execute any code they choose, gaining control over your system and causing absolute devastation—stealing data, altering files, or even crashing the server entirely! With such high stakes, this is not a vulnerability to overlook!
Think of it as a chef who blindly follows an incorrect recipe without checking the ingredients. If that recipe calls for something dangerous, the results can be disastrous! This vulnerability arises from the deserialization of untrusted data in pyfory, where an attacker can manipulate the process to execute arbitrary code by exploiting the vulnerable `pickle.loads` method.
An attacker could potentially execute any code they choose, gaining control over your system and causing absolute devastation—stealing data, altering files, or even crashing the server entirely! With such high stakes, this is not a vulnerability to overlook! Upgrade to pyfory version 0.12.3 or later immediately to eliminate the fallback to the vulnerable serializer. It's also wise to audit your code for any usage of untrusted serialized data. Stay vigilant! You've got this! Patch up and secure your application like the hero you are! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| apache/fory | ≥ 0.1.0, ≤ 0.10.3 | — |
| apache/fory | ≥ 0.12.0, ≤ 0.12.2 | — |