CVE-2025-56005: 
PostgreSQL vulnerability analysis and mitigation

CVE-2025-56005 is a deserialization vulnerability in PLY (Python Lex-Yacc) version 3.11 that allows Remote Code Execution (RCE) via the undocumented picklefile parameter in the yacc() function. The parameter causes PLY to deserialize a .pkl file using Python's pickle.load() without any validation, enabling arbitrary code execution. The vulnerability affects only PLY 3.11 as distributed on PyPI; the GitHub repository has since been archived by its maintainer as of December 21, 2025, with no further maintenance planned. It was first disclosed on January 20, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) as assessed by CISA-ADP (Openwall oss-sec, Oracle Advisory). Note: This CVE is disputed — a third party has stated that the proof of concept does not successfully demonstrate arbitrary code execution (Openwall oss-sec).

The root cause is CWE-502 (Deserialization of Untrusted Data): the yacc() function in ply/yacc.py accepts a picklefile parameter that invokes LRTable.read_pickle(), which calls Python's pickle.load() on the supplied file without any integrity or content validation. Because Python's pickle module allows embedded code execution via the __reduce__() method, an attacker who can supply or replace the .pkl file can embed arbitrary OS commands that execute during parser initialization — before any parsing logic runs. The parameter is entirely absent from official PLY documentation and the GitHub repository, making it a hidden attack surface. A public PoC crafts a malicious pickle payload embedding an Exploit class with a __reduce__() method that executes a shell command when deserialized (GitHub PoC, Openwall oss-sec).

Successful exploitation results in arbitrary code execution on the host running the PLY-based application, with full confidentiality, integrity, and availability impact. Code execution occurs during parser initialization, meaning it can happen before any application-level security controls are invoked. The undocumented nature of the feature makes it particularly difficult to detect during security reviews, and it can be abused to establish persistent backdoors in environments where parser table files are cached, shared between services, or loaded from CI/CD pipelines or writable paths (GitHub PoC, Oracle Advisory).

Multiple public proof-of-concept exploits are available on GitHub and referenced in oss-security mailing lists, including repositories by the original reporter and a counter-analysis disputing the PoC's effectiveness (GitHub PoC, GitHub PoC 2, Exploit Rejection). There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been made. The EPSS score is approximately 0.365%, indicating a low but non-negligible probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVE is marked as disputed by MITRE, with a third party asserting the PoC fails to complete successfully (Openwall oss-sec).

1. Identify target: Locate applications that use PLY 3.11 (PyPI distribution) and invoke yacc() with the picklefile parameter pointing to a file path the attacker can write to or replace (e.g., a cached parser table in a shared directory, CI/CD artifact store, or writable path).
2. Craft malicious pickle payload: Create a Python class with a __reduce__() method that returns a callable and arguments representing the desired OS command (e.g., os.system with a reverse shell command).
3. Serialize the payload: Embed the malicious object within a dictionary matching PLY's expected pickle structure (_tabversion, _lr_action, _lr_goto, _lr_productions, _lr_method) and serialize it to a .pkl file using pickle.dump().
4. Place the malicious file: Write or replace the target .pkl file at the path expected by the vulnerable application's yacc(picklefile=...) call.
5. Trigger deserialization: Wait for or cause the application to initialize its PLY parser. When yacc(picklefile='exploit.pkl') is called, pickle.load() deserializes the file, invoking __reduce__() and executing the embedded command before any parsing logic runs.
6. Achieve code execution: The attacker's payload executes with the privileges of the application process (GitHub PoC, Openwall oss-sec).

• File System: Unexpected or recently modified .pkl files in application directories, cache directories, or CI/CD artifact paths used by PLY-based applications; presence of files like /tmp/pwned or other artifacts created by PoC payloads; new or modified files in parser table cache locations.
• Process: Unusual child processes spawned by Python interpreter processes running PLY-based applications (e.g., sh, bash, curl, wget, nc) during application startup or parser initialization.
• Logs: Application logs showing errors or unexpected output during yacc() initialization; Python tracebacks related to pickle deserialization in PLY-dependent services.
• Network: Unexpected outbound network connections from Python application processes shortly after startup, particularly to unknown external IPs (indicative of reverse shell payloads).

No official patch has been released for PLY 3.11, and the project has been abandoned by its maintainer (archived on GitHub as of December 21, 2025). Oracle Solaris 11.4 users should apply the patches referenced in the April 2026 Oracle Solaris Third Party Bulletin (Oracle Advisory). Fedora and openSUSE have issued updated packages addressing this CVE. Immediate mitigations include: (1) auditing all codebases for use of yacc(picklefile=...) and removing or restricting this parameter; (2) never loading .pkl files from user-controlled, shared, or writable locations; (3) regenerating parser tables at runtime rather than loading from disk; (4) migrating to an actively maintained parsing library. Treat all pickle files as untrusted input (GitHub PoC, Openwall oss-sec).

The vulnerability generated notable discussion on the oss-security mailing list, where Oracle's Alan Coopersmith highlighted that the PLY repository had been archived and abandoned by its maintainer, and community members noted the maintainer's farewell message recommending alternative parsing libraries (Openwall oss-sec, Openwall oss-sec reply). A third-party researcher published a counter-analysis (ply_exploit_rejection) arguing the CVE should be rejected because the PoC does not successfully demonstrate arbitrary code execution, leading MITRE to add a "disputed" tag to the CVE record in February 2026. Security media including SecurityOnline, CyberSecurityNews, and eSecurity Planet covered the issue, with headlines emphasizing the "ghost in the code" angle given the library's abandoned status. The CVE was also featured in The Hacker News weekly recap and trended on Reddit's CVEWatch community.