CVE-2025-6279: Critical Deserialization Vulnerability in Upsonic Package
Summary
CVE-2025-6279: A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6. Affects upsonic versions < 0.56.0. Fixed in 0.56.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Upsonic is a Python package designed for efficient audio processing and manipulation. It leverages cloudpickle for serialization and deserialization of Python objects, enabling users to save and load complex data structures seamlessly. However, versions up to 0.55.6 are vulnerable to a critical deserialization issue that can be exploited by attackers.
Vulnerability Detail
A critical vulnerability has been identified in the Upsonic package, specifically in the cloudpickle.loads function located in the /tools/add_tool file. This vulnerability allows for deserialization attacks, where an attacker can manipulate serialized data to execute arbitrary code upon deserialization. The issue affects all versions up to 0.55.6 and poses significant risks, including unauthorized access and potential system compromise.
How To Fix
Minimum fixed version
0.56.0
This is the first release that contains the fix.
pip install --upgrade "upsonic==0.56.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the affected cloudpickle.loads function with untrusted data. Implement strict validation of any serialized data before processing it to minimize the risk of exploitation.
Conclusion
The critical vulnerability CVE-2025-6279 in the Upsonic package poses significant risks due to its deserialization flaw. Users are strongly advised to upgrade to version 0.56.0 or later to protect their applications from potential exploitation. Implementing workarounds and monitoring tools like Vulert can further enhance security.
See every vulnerability recorded for upsonic →
FAQ
CVE-2025-6279 is a critical vulnerability in the Upsonic package that allows for deserialization attacks, potentially leading to unauthorized code execution.
All versions of Upsonic up to and including 0.55.6 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 8.0, indicating a high severity level.
If immediate upgrading is not possible, implement strict validation of serialized data and avoid using the vulnerable function with untrusted inputs.
References
Related vulnerabilities
Recent vulnerabilities recorded for upsonic.
