CVE Explorer
CVE-2025-61765
python-socketio is a Python implementation of the Socket.IO realtime client and server. A remote code execution vulnerability in python-socketio versions prior to 5.14.0 allows attackers to execute arbitrary Python code through malicious pickle deserialization in multi-server deployments on which the attacker previously gained access to the message queue that the servers use for internal communications. When Socket.IO servers are configured to use a message queue backend such as Redis for inter-
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"python-socketio","vendor":"miguelgrinberg","versions":[{"status":"affected","version":">= 0.8.0, < 5.14.0"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:d592d69a0c63bb583adb5432e54df3981ad2198124ad0265345feb1db089e9ce · sha256:f7f4e44c03b56d59… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:d592d69a0c63bb583adb5432e54df3981ad2198124ad0265345feb1db089e9ce · sha256:f7f4e44c03b56d59… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-502","description":"CWE-502: Deserialization of Untrusted Data","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:d592d69a0c63bb583adb5432e54df3981ad2198124ad0265345feb1db089e9ce · sha256:f7f4e44c03b56d59… · /containers/cna/problemTypes/0/descriptions/0
Source references
4 source assertions{"name":"https://github.com/miguelgrinberg/python-socketio/commit/53f6be094257ed81476b0e212c8cddd6d06ca39a","tags":["x_refsource_MISC"],"url":"https://github.com/miguelgrinberg/python-socketio/commit/53f6be094257ed81476b0e212c8cddd6d06ca39a"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d592d69a0c63bb583adb5432e54df3981ad2198124ad0265345feb1db089e9ce · sha256:f7f4e44c03b56d59… · /containers/cna/references/1
{"name":"https://github.com/miguelgrinberg/python-socketio/security/advisories/GHSA-g8c6-8fjj-2r4m","tags":["x_refsource_CONFIRM"],"url":"https://github.com/miguelgrinberg/python-socketio/security/advisories/GHSA-g8c6-8fjj-2r4m"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d592d69a0c63bb583adb5432e54df3981ad2198124ad0265345feb1db089e9ce · sha256:f7f4e44c03b56d59… · /containers/cna/references/0
{"name":"https://www.bluerock.io/post/cve-2025-61765-bluerock-discovers-critical-rce-in-socket-io-ecosystem","tags":["x_refsource_MISC"],"url":"https://www.bluerock.io/post/cve-2025-61765-bluerock-discovers-critical-rce-in-socket-io-ecosystem"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d592d69a0c63bb583adb5432e54df3981ad2198124ad0265345feb1db089e9ce · sha256:f7f4e44c03b56d59… · /containers/cna/references/2
{"url":"https://www.bluerock.io/post/cve-2025-61765-bluerock-discovers-critical-rce-in-socket-io-ecosystem"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d592d69a0c63bb583adb5432e54df3981ad2198124ad0265345feb1db089e9ce · sha256:f7f4e44c03b56d59… · /containers/adp/1/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.