CVE-2025-63675CWE-502insecure-deserialization

CVE-2025-63675

Medium · published October 31, 2025

CVSS v3.1

6.9

EPSS

Percentile

15.8

In the wild

Unconfirmed

What it is

cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.

The record

Technical detail

CVSS v3.1: 6.9 · MEDIUM
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0: Not supplied
EPSS: 0.00252 · 15.8th percentile
Weakness: CWE-502 · Deserialization of Untrusted Data
Published: 2025-10-31T11:15Z

Affected products (1)

Product	Versions	Fixed in
netinvent/cryptidy	≤ 1.2.4	—

References (3)

https://github.com/javiermorales36/cryptidy-analysis · [email protected]https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.py#L220-L238 · [email protected]https://github.com/javiermorales36/cryptidy-analysis · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

31 OCT 00:00Z
cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used
cvelistv5