CVE Explorer
CVE-2026-25632
EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subp
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"EPyT-Flow","vendor":"WaterFutures","versions":[{"status":"affected","version":"< 0.16.1"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:07893d8a47b5e1c73349a86eb8a5d7cc4ae15b9150a3646be543ba7d81e9bf36 · sha256:993589ac5834a49b… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:07893d8a47b5e1c73349a86eb8a5d7cc4ae15b9150a3646be543ba7d81e9bf36 · sha256:993589ac5834a49b… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-502","description":"CWE-502: Deserialization of Untrusted Data","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:07893d8a47b5e1c73349a86eb8a5d7cc4ae15b9150a3646be543ba7d81e9bf36 · sha256:993589ac5834a49b… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"name":"https://github.com/WaterFutures/EPyT-Flow/commit/3fff9151494c7dbc72073830b734f0a7e550e385","tags":["x_refsource_MISC"],"url":"https://github.com/WaterFutures/EPyT-Flow/commit/3fff9151494c7dbc72073830b734f0a7e550e385"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:07893d8a47b5e1c73349a86eb8a5d7cc4ae15b9150a3646be543ba7d81e9bf36 · sha256:993589ac5834a49b… · /containers/cna/references/1
{"name":"https://github.com/WaterFutures/EPyT-Flow/releases/tag/v0.16.1","tags":["x_refsource_MISC"],"url":"https://github.com/WaterFutures/EPyT-Flow/releases/tag/v0.16.1"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:07893d8a47b5e1c73349a86eb8a5d7cc4ae15b9150a3646be543ba7d81e9bf36 · sha256:993589ac5834a49b… · /containers/cna/references/2
{"name":"https://github.com/WaterFutures/EPyT-Flow/security/advisories/GHSA-74vm-8frp-7w68","tags":["x_refsource_CONFIRM"],"url":"https://github.com/WaterFutures/EPyT-Flow/security/advisories/GHSA-74vm-8frp-7w68"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:07893d8a47b5e1c73349a86eb8a5d7cc4ae15b9150a3646be543ba7d81e9bf36 · sha256:993589ac5834a49b… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.