CVE-2025-58367
DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are vulnerable to class pollution via the Delta class constructor, and when combined with a gadget available in DeltaDiff, it can lead to Denial of Service and Remote Code Execution (via insecure Pickle deserialization) exploitation. The gadget available in DeepDiff allows `deepdiff.serialization.SAFE_TO_IMPORT` to be modified to allow dangerous classes such as posix.system, and then perform insecure Pickle deserialization via the Delta class. This potentially allows any Python code to be executed, given that the input to Delta is user-controlled. Depending on the application where DeepDiff is used, this can also lead to other vulnerabilities. This is fixed in version 8.6.1.
EPSS 1.12% · 63.9th percentile
Risk Scores
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| seperman | deepdiff | * |
| PyPI | deepdiff | 5.0.0 |
Timeline
- Jan 21, 1970 Security Advisory
- Sep 3, 2025 CVE Published
- Sep 6, 2025 EPSS Score
- Sep 6, 2025 Coalition ESS Score
- Sep 6, 2025 PoC Published
- Sep 6, 2025 PoC Published
- Sep 8, 2025 Coalition ESS Score
- Sep 10, 2025 Coalition ESS Score
- Sep 10, 2025 PoC Published
- Sep 11, 2025 Coalition ESS Score
- Sep 14, 2025 EPSS Score
- Sep 21, 2025 EPSS Score
References
- https://github.com/dgilland/pydash/issues/180 discussion
- https://github.com/dgilland/pydash/commit/2015f0a4bcdbc3a5b27652e38fe97b3ee13ac15f fix
- https://github.com/seperman/deepdiff/commit/c69c06c13f75e849c770ade3f556cd16209fd183 fix
- https://github.com/seperman/deepdiff/releases/tag/8.6.1 fix
- https://github.com/seperman/deepdiff/security/advisories/GHSA-mw26-5g2v-hqw3 url
- https://nvd.nist.gov/vuln/detail/CVE-2025-58367 advisory
- https://github.com/seperman/deepdiff package