CVSS 3.1
3.3 lowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:NCVE-2019-12760
Low (3.3) in parso project parso. EPSS 1.5% chance of exploitation in the next 30 days. Fixed in parso 0.5.0.
A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution. NOTE: This is disputed because "the cache directory is not under control of the attacker in any common configuration.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- parso_project:parso
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| PYSEC-2019-109 | PyPI | parso | <0.5.0 | 0.5.0 |