EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)
Impact
EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files.
Patches
EPyT-Flow has been patched in 0.16.1 -- affects all versions <= 0.16.0
Workarounds
Do not load any JSON from untrusted sources and do not expose the REST API.
Credits
EPyT-Flow thanks Jarrett Chan (@syphonetic) for detecting and reporting the bug.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | epyt-flow | < 0.16.1 | 0.16.1 |
References
- https://github.com/WaterFutures/EPyT-Flow/security/advisories/GHSA-74vm-8frp-7w68
- https://nvd.nist.gov/vuln/detail/CVE-2026-25632
- https://github.com/WaterFutures/EPyT-Flow/commit/3fff9151494c7dbc72073830b734f0a7e550e385
- https://github.com/WaterFutures/EPyT-Flow
- https://github.com/WaterFutures/EPyT-Flow/releases/tag/v0.16.1
- https://pypi.org/project/epyt-flow
- https://github.com/advisories/GHSA-74vm-8frp-7w68
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-502- Platform
- Python (PyPI)
- Package
epyt-flow- Disclosed
- 04.02.2026
- Updated
- 11.10.2026 12:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-74vm-8frp-7w68 - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2026-330 - PyPA Advisory Database; CC BY 4.0
Vulnerability history: epyt-flow
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.