Critical Malicious Code Vulnerability in Pydantic Package
Summary
MAL-2025-4867: Malicious code in pydantic (npm). Affects pydantic versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pydantic is a popular data validation and settings management library for Python, primarily used for parsing and validating data structures. It allows developers to define data models using Python type annotations, ensuring that the data conforms to expected formats. However, a recent vulnerability has been identified that compromises the integrity of this package, making it essential for users to be aware of the risks involved.
Vulnerability Detail
The vulnerability identified in the Pydantic package is classified as malicious code injection. Originating from a compromised version of the package, this vulnerability allows unauthorized access to the systems where the package is installed. It poses severe risks, including the potential exposure of sensitive data such as secrets and keys. The malicious code can lead to full control of the affected computer, making it imperative for users to act swiftly to mitigate the risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall pydanticIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users should consider isolating the affected system from the network to prevent further exploitation. Additionally, all sensitive data should be secured and monitored for any unauthorized access.
Conclusion
The discovery of malicious code in the Pydantic package highlights the importance of vigilance in managing open-source dependencies. Users must act promptly to remove the compromised package and secure their systems to prevent unauthorized access.
See every vulnerability recorded for pydantic →
FAQ
The vulnerability involves malicious code that can compromise the security of systems where the Pydantic package is installed.
If you have the Pydantic package installed, your system may be compromised. It is advisable to remove the package and rotate any sensitive keys.
Isolate the affected system from the network and secure sensitive data until you can remove the package or apply a patch.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just your package-lock.json file.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for pydantic.
