{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "fugue"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-62703"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-25T20:39:15Z",
    "nvd_published_at": "2025-11-25T22:15:47Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe Fugue framework implements an RPC server system for distributed computing operations. In the core\u00a0functionality of the RPC server implementation, I\u00a0found that\u00a0the\u00a0_decode()\u00a0function in\u00a0fugue/rpc/flask.py\u00a0directly uses\u00a0cloudpickle.loads()\u00a0to deserialize data\u00a0without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC\u00a0server.The vulnerability exists in the RPC communication mechanism where the client can\u00a0send arbitrary serialized Python objects that will be deserialized on the server\u00a0side, allowing\u00a0attackers to\u00a0execute arbitrary code\u00a0on the victim\u0027s machine.\n\n### Details\n_decode()\u00a0function in\u00a0fugue/rpc/flask.py directly uses\u00a0cloudpickle.loads()\u00a0to deserialize data\u00a0without any sanitization.\n\n### PoC\n* Step1:\nThe victim user starts an RPC\u00a0server binding to open network using\u00a0the Fugue framework. Here, I use the\u00a0official RPC\u00a0server code\u00a0to initialize\u00a0the server. \n\n* Step2:\nThe attacker modifies\u00a0the\u00a0_encode()\u00a0function\u00a0in\u00a0fugue/rpc/flask.py\u00a0to\u00a0inject malicious pickle data:\n\n\u003cimg width=\"740\" height=\"260\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6064516b-e1a6-45fa-a91c-8e276bc4a106\" /\u003e\n\nIn this example, attacker modifies _encode to let the victim execute command \u201cls -l\u201d\n\n* Step 3:\nThe attacker then\u00a0uses the RPC client to send\u00a0the malicious\u00a0request\n\nFugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py.  In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py.\n\n\n### Impact\nRemote code execution in the victim\u0027s machine. Once the victim starts\u00a0the RPCServer with network binding (especially\u00a00.0.0.0), an attacker on\u00a0the network\u00a0can gain arbitrary code execution by connecting to the RPCServer\u00a0and sending crafted pickle payloads. This vulnerability allows\u00a0for:\n\n- Complete system compromise\n- Data exfiltration\n- Lateral movement within the network\n- Denial of service attacks\n- Installation of persistent backdoors\n\n### Mitigation\n1. **Replace unsafe deserialization**: Replace `pickle.loads()` with safer alternatives such as:\n   - JSON serialization for simple data structures\n   - Protocol Buffers or MessagePack for complex data\n   - If pickle must be used, implement a custom `Unpickler` with a restricted `find_class()` method that only allows whitelisted classes\n\n2. **Network security**: \n   - If the service is intended for internal use only, bind to localhost (`127.0.0.1`) instead of `0.0.0.0`\n   - Implement authentication and authorization mechanisms\n\n3. **Security warnings**: When starting the service on public interfaces, display clear security warnings to inform users about the risks.\n\nAttachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing",
  "id": "GHSA-xv5p-fjw5-vrj6",
  "modified": "2025-11-27T09:00:39Z",
  "published": "2025-11-25T20:39:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fugue-project/fugue/security/advisories/GHSA-xv5p-fjw5-vrj6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62703"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fugue-project/fugue/commit/6f25326779fd1f528198098d6287c5a863176fc0"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fugue-project/fugue"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Fugue is Vulnerable to Remote Code Execution\u00a0by Pickle Deserialization via FlaskRPCServer"
}