Home > Vulnerability Database > CVE-2025-56005

Mend.io Vulnerability Database

CVE-2025-56005

Good to know:

Date: January 19, 2026

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the "picklefile" parameter in the "yacc()" function. This parameter accepts a ".pkl" file that is deserialized with "pickle.load()" without validation. Because "pickle" allows execution of embedded code via "__reduce__()", an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.

Severity Score

9.8

Related Resources (12)

Url: http://www.openwall.com/lists/oss-security/2026/01/23/4

Url: https://github.com/bohmiiidd/Undocumented-RCE-in-PLY

Url: https://github.com/tom025/ply_exploit_rejection

Url: https://github.com/bohmiiidd/Undocumument_RCE_PLY-yacc-CVE-2025-56005

Url: http://www.openwall.com/lists/oss-security/2026/01/30/1

Url: http://www.openwall.com/lists/oss-security/2026/01/28/5

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-56005

Url: http://www.openwall.com/lists/oss-security/2026/01/29/2

Url: http://www.openwall.com/lists/oss-security/2026/01/29/1

Url: https://github.com/tom025/ply_exploit_rejection/issues/1

Url: http://www.openwall.com/lists/oss-security/2026/01/23/5

Url: https://www.mend.io/vulnerability-database/CVE-2025-56005

Severity Score

9.8

Weakness Type (CWE)

Deserialization of Untrusted Data

CWE-502

CVSS v3.1

Base Score:	9.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Mend.io Vulnerability Database

We found results for “”

CVE-2025-56005

Good to know:

Date: January 19, 2026

Severity Score

Related Resources (12)

Severity Score

Weakness Type (CWE)

CVSS v3.1

Do you need more information?