Improperly Controlled Modification of Dynamically-Determined Object Attributes in deepdiff - CVE-2025-58367

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU139903

Improperly Controlled Modification of Dynamically-Determined Object Attributes in deepdiff - CVE-2025-58367

Published: July 28, 2026


Vulnerability identifier: #VU139903
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-58367
CWE-ID: CWE-915
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improperly controlled modification of dynamically-determined object attributes in the Delta class when processing user-controlled input passed to the constructor. A remote attacker can supply crafted Delta data to modify deepdiff.serialization.SAFE_TO_IMPORT and trigger unsafe pickle deserialization to execute arbitrary code.

Only applications that pass untrusted user input directly into Delta are affected. Exploitation can use bytes input directly, and dictionary input may also be exploitable depending on the application.


Affected software

deepdiff
Fedora
openSUSE Leap
python-orderly-set
python311-deepdiff
python-deepdiff

How to mitigate CVE-2025-58367

Install security update from vendor's website.

deepdiff - update to 8.6.1
python-orderly-set - addressed in versions 5.5.0-2.fc41, 5.5.0-2.fc42
python311-deepdiff - update to 6.3.0-150600.3.3.1
python-deepdiff - addressed in versions 8.6.1-1.el10_1, 8.6.1-1.el10_2, 8.6.1-1.fc41, 8.6.1-1.fc42

External References

Related Security Bulletins