{"cve":"CVE-2025-58367","nvd":{"published":"2025-09-05T22:15:34.710","modified":"2026-10-18T21:10:00.120","status":"Deferred","description":"DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are vulnerable to class pollution via the Delta class constructor, and when combined with a gadget available in DeltaDiff, it can lead to Denial of Service and Remote Code Execution (via insecure Pickle deserialization) exploitation. The gadget available in DeepDiff allows `deepdiff.serialization.SAFE_TO_IMPORT` to be modified to allow dangerous classes such as posix.system, and then perform insecure Pickle deserialization via the Delta class. This potentially allows any Python code to be executed, given that the input to Delta is user-controlled. Depending on the application where DeepDiff is used, this can also lead to other vulnerabilities. This is fixed in version 8.6.1.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":10.0},"cvss_v3":null,"cwes":["CWE-915"],"references":["https://github.com/seperman/deepdiff/commit/c69c06c13f75e849c770ade3f556cd16209fd183","https://github.com/seperman/deepdiff/releases/tag/8.6.1","https://github.com/seperman/deepdiff/security/advisories/GHSA-mw26-5g2v-hqw3"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:08:41.295252406+00:00"},"epss":{"cve":"CVE-2025-58367","score":0.01188,"percentile":0.67683,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-mw26-5g2v-hqw3","url":"https://osv.dev/vulnerability/GHSA-mw26-5g2v-hqw3","summary":"DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more","modified":"2026-06-29T12:26:38.093396079Z","packages":[{"ecosystem":"PyPI","name":"deepdiff","purl":"pkg:pypi/deepdiff","ranges":[">=5.0.0 <8.6.1"],"fixed":["8.6.1"]}]},{"id":"PYSEC-2026-327","url":"https://osv.dev/vulnerability/PYSEC-2026-327","summary":"DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more","modified":"2026-07-13T16:15:23.353425669Z","packages":[{"ecosystem":"PyPI","name":"deepdiff","purl":"pkg:pypi/deepdiff","ranges":[">=5.0.0 <8.6.1"],"fixed":["8.6.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}