« Volver al listado

CVE-2026-25632

Estado: AnalizadaCrítica (10)—

EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files. This vulnerability is fixed in 0.16.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

REST API expuesta en red sin autenticación (AV:N/PR:N) permite deserialización insegura de JSON para ejecución de código OS (subprocess.Popen).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software InstallationLimit Access to Resource Over Network

Tecnologías afectadas (1)

Waterfutures — Epyt-flow

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-25632",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25632",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-06T20:56:14.947947Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "WaterFutures",
          "product": "EPyT-Flow",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.16.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-06T21:16:18.377",
  "references": [
    {
      "url": "https://github.com/WaterFutures/EPyT-Flow/commit/3fff9151494c7dbc72073830b734f0a7e550e385",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/WaterFutures/EPyT-Flow/releases/tag/v0.16.1",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/WaterFutures/EPyT-Flow/security/advisories/GHSA-74vm-8frp-7w68",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files. This vulnerability is fixed in 0.16.1."
    },
    {
      "lang": "es",
      "value": "EPyT-Flow es un paquete de Python diseñado para la fácil generación de datos de escenarios hidráulicos y de calidad del agua de redes de distribución de agua. Antes de la versión 0.16.1, la API REST de EPyT-Flow analiza cuerpos de solicitud JSON controlados por el atacante utilizando un deserializador personalizado (my_load_from_json) que soporta un campo type. Cuando type está presente, el deserializador importa dinámicamente un módulo/clase especificado por el atacante y lo instancia con argumentos proporcionados por el atacante. Esto permite invocar clases peligrosas como subprocess.Popen, lo que puede llevar a la ejecución de comandos del sistema operativo durante el análisis JSON. Esto también afecta la carga de archivos JSON. Esta vulnerabilidad está corregida en la versión 0.16.1."
    }
  ],
  "lastModified": "2026-06-17T10:24:58.957",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:waterfutures:epyt-flow:*:*:*:*:*:python:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58884503-AFDE-408F-994A-A94C23E8AC3C",
              "versionEndExcluding": "0.16.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}