Critical JSON Deserialization Vulnerability in EPyT-Flow
Summary
GHSA-74vm-8frp-7w68: EPyT-Flow vulnerable to unsafe JSON deserialization (type). Affects epyt-flow versions < 0.16.1. Fixed in 0.16.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
EPyT-Flow is a Python package designed for managing and executing workflows in a flexible manner. It provides a REST API for users to interact with the workflows programmatically. However, it has a critical vulnerability that allows for unsafe JSON deserialization, which can be exploited by attackers to execute arbitrary OS commands.
Vulnerability Detail
The vulnerability arises from EPyT-Flow's REST API, which uses a custom deserializer (my_load_from_json) that accepts a type field in JSON request bodies. This allows an attacker to specify a module or class to be dynamically imported and instantiated with arbitrary arguments. Consequently, this could lead to the execution of dangerous classes, such as subprocess.Popen, resulting in OS command execution during JSON parsing. This vulnerability affects all versions of EPyT-Flow up to and including 0.16.0.
How To Fix
Minimum fixed version
0.16.1
This is the first release that contains the fix.
pip install --upgrade "epyt-flow==0.16.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid loading any JSON from untrusted sources and refrain from exposing the REST API to the public. This can help mitigate the risk until the package is updated.
Conclusion
The EPyT-Flow package has a critical vulnerability related to unsafe JSON deserialization, which can lead to severe security risks such as OS command execution. It is essential to update to the patched version 0.16.1 or later and implement recommended workarounds to mitigate potential threats.
See every vulnerability recorded for epyt-flow →
FAQ
The vulnerability has a CVSS score of 10.0, indicating it is critical and poses a significant risk.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
If an immediate update is not possible, ensure that you do not load JSON from untrusted sources and limit access to the REST API.
Exploitation of this vulnerability can lead to OS command execution, allowing attackers to run arbitrary commands on the server hosting the application.
The vulnerability was detected and reported by Jarrett Chan (@syphonetic), who contributed to improving the security of EPyT-Flow.
References
Related vulnerabilities
Recent vulnerabilities recorded for epyt-flow.
