p PatchFirst

CVE-2025-58367

CVE-2025-58367 · DeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are vulnerable to class pollution via the Delta class constructor, and when combined with a gadget available in DeltaDiff, it can lead to Denial of Service and Remote Code Execution (via insecure Pickle deserialization) exploitation. The gadget available in DeepDiff allows `deepdiff.serialization.SAFE_TO_IMPORT` to be modified to allow dangerous classes such as posix.system, and then perform insecure Pickle deserialization via the Delta class. This potentially allows any Python code to be executed, given that the input to Delta is user-controlled. Depending on the application where DeepDiff is used, this can also lead to other vulnerabilities. This is fixed in version 8.6.1.

CVSS 10.0 · Critical · EPSS 1.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • deepdiff

    Versions
    • >= 5.0.0, < 8.6.1: Affected

    No fix published

  • deepdiff Debian:12

    Versions
    • 6.2.2-1
    • 6.7.1-1
    • 6.7.1-2
    • 8.1.1-1
    • 8.1.1-2
    • 8.1.1-3
    • 8.1.1-4
    • 8.6.1-1
    • 9.0.0-1
    • 9.0.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • deepdiff Debian:13

    Versions
    • 8.1.1-4
    Affected ranges
    • ECOSYSTEM: < 8.1.1-4+deb13u1

    Update to 8.1.1-4+deb13u1

  • deepdiff Debian:14

    Versions
    • 8.1.1-4
    Affected ranges
    • ECOSYSTEM: < 8.6.1-1

    Update to 8.6.1-1

  • deepdiff PyPI

    Versions
    • 5.0.0
    • 5.0.1
    • 5.0.2
    • 5.2.0
    • 5.2.1
    • 5.2.2
    • 5.2.3
    • 5.3.0
    • 5.5.0
    • 5.6.0
    • 5.7.0
    • 5.8.0
    • 5.8.1
    • 6.2.1
    • 6.2.2
    • 6.2.3
    • 6.3.0
    • 6.3.1
    • 6.4.0
    • 6.4.1
    • 6.5.0
    • 6.6.0
    • 6.6.1
    • 6.7.0
    • 6.7.1
    • 7.0.0
    • 7.0.1
    • 8.0.0
    • 8.0.1
    • 8.1.0
    • 8.1.1
    • 8.2.0
    • 8.3.0
    • 8.4.0
    • 8.4.1
    • 8.4.2
    • 8.5.0
    • 8.6.0
    Affected ranges
    • ECOSYSTEM: ≥ 5.0.0, < 8.6.1

    Update to 8.6.1

  • deepdiff Ubuntu:20.04:LTS

    Versions
    • 3.3.0-1
    • 3.3.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • deepdiff Ubuntu:22.04:LTS

    Versions
    • 3.3.0-2
    • 3.3.0-2ubuntu1
    • 3.3.0-3
    • 5.6.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • deepdiff Ubuntu:24.04:LTS

    Versions
    • 6.2.2-1
    • 6.7.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • deepdiff Ubuntu:25.10

    Versions
    • 8.1.1-3
    • 8.1.1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →