{"cve":"CVE-2025-62515","nvd":{"published":"2025-10-17T21:15:36.783","modified":"2026-10-08T22:10:00.563","status":"Deferred","description":"pyquokka is a framework for making data lakes work for time series. In versions 0.3.1 and prior, the FlightServer class directly uses pickle.loads() to deserialize action bodies received from Flight clients without any sanitization or validation in the do_action() method. The vulnerable code is located in pyquokka/flight.py at line 283 where arbitrary data from Flight clients is directly passed to pickle.loads(). When FlightServer is configured to listen on 0.0.0.0, this allows attackers across the entire network to perform arbitrary remote code execution by sending malicious pickled payloads through the set_configs action. Additional vulnerability points exist in the cache_garbage_collect, do_put, and do_get functions where pickle.loads is used to deserialize untrusted remote data.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-502"],"references":["https://github.com/marsupialtail/quokka/security/advisories/GHSA-f74j-gffq-vm9p"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:12:35.277909958+00:00"},"epss":{"cve":"CVE-2025-62515","score":0.0089,"percentile":0.59093,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-f74j-gffq-vm9p","url":"https://osv.dev/vulnerability/GHSA-f74j-gffq-vm9p","summary":"pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer ","modified":"2026-06-29T12:26:32.481194301Z","packages":[{"ecosystem":"PyPI","name":"pyquokka","purl":"pkg:pypi/pyquokka","ranges":["<=0.3.1"],"fixed":[]}]},{"id":"PYSEC-2026-503","url":"https://osv.dev/vulnerability/PYSEC-2026-503","summary":"pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer ","modified":"2026-07-01T20:23:03.066302Z","packages":[{"ecosystem":"PyPI","name":"pyquokka","purl":"pkg:pypi/pyquokka","ranges":["<=0.3.1"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}