CVE-2026-25632: EPyT-Flow Vulnerable to Unsafe JSON Deserialization
Summary
CVE-2026-25632: EPyT-Flow vulnerable to unsafe JSON deserialization (type). Affects epyt-flow versions < 0.16.1. Fixed in 0.16.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
EPyT-Flow is a Python package that provides a REST API for managing workflows and data processing tasks. It allows users to define, execute, and monitor workflows through a simple interface. However, the package has a critical vulnerability that arises from its handling of JSON request bodies, specifically through a custom deserializer that can be exploited by attackers.
Vulnerability Detail
The vulnerability in EPyT-Flow stems from its REST API's use of a custom JSON deserializer (my_load_from_json) that accepts a type field. This field allows attackers to specify a module or class to be dynamically imported and instantiated with arbitrary arguments. This can lead to the execution of dangerous classes, such as subprocess.Popen, enabling OS command execution during JSON parsing. The vulnerability affects all versions of EPyT-Flow up to and including 0.16.0, posing a significant risk to systems that utilize this package.
How To Fix
Minimum fixed version
0.16.1
This is the first release that contains the fix.
pip install --upgrade "epyt-flow==0.16.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid loading any JSON from untrusted sources and refrain from exposing the REST API to the public. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The vulnerability identified as CVE-2026-25632 in EPyT-Flow poses a serious risk due to unsafe JSON deserialization, which can lead to OS command execution. It is crucial for users to update to version 0.16.1 or later to mitigate this risk. Until an update can be applied, users should implement workarounds to protect their systems.
See every vulnerability recorded for epyt-flow →
FAQ
The vulnerability allows for unsafe JSON deserialization, enabling attackers to execute arbitrary OS commands.
All versions of EPyT-Flow up to and including 0.16.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 10.0, indicating a critical level of severity.
If you cannot update the package, ensure that you do not load JSON from untrusted sources and limit access to the REST API.
References
Related vulnerabilities
Recent vulnerabilities recorded for epyt-flow.
