CVE-2025-63675: 
Python vulnerability analysis and mitigation

CVE-2025-63675 is a deserialization of untrusted data vulnerability in the cryptidy Python library (versions through 1.2.4) that allows arbitrary code execution via maliciously crafted pickle payloads. The flaw resides in the aes_decrypt_message function within cryptidy/symmetric_encryption.py, where pickle.loads() is called on decrypted data without validation. It was published on October 31, 2025, and assigned GHSA-97w9-v595-3h5q. CVSS v3.1 scores vary by source: NVD/Feedly rates it 8.8 (High) while the GitHub Advisory Database rates it 6.9 (Moderate) (Github Advisory, Feedly).

The root cause is CWE-502 (Deserialization of Untrusted Data): the aes_decrypt_message function in symmetric_encryption.py (lines 220–238) unconditionally calls pickle.loads(data) on the AES-decrypted output without any class restriction or integrity check beyond AES-GCM tag verification (cryptidy source). An attacker who can supply a crafted ciphertext — encrypted with a known or compromised AES key — can embed a malicious pickle payload that executes arbitrary Python code upon decryption. Exploitation requires user interaction (i.e., the application must process the attacker-supplied encrypted message), and the attacker must be able to deliver the malicious ciphertext to the target application. A public PoC repository including a malicious payload binary and exploit runner is available (PoC Repo).

Successful exploitation results in arbitrary code execution with the privileges of the process running the cryptidy library, enabling full system compromise including unauthorized access, data theft, data manipulation, and denial of service (Github Advisory). Confidentiality, integrity, and availability are all rated High by NVD. Depending on the deployment context, an attacker could pivot laterally within the environment or escalate privileges if the application runs with elevated rights (PoC Repo).

A public proof-of-concept exploit is available on GitHub, including a malicious pickle payload (payload_malicioso.bin) and an exploit runner script (ejecutar_exploit.py) (PoC Repo). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.032–0.086%, indicating a low but non-negligible probability of exploitation in the near term (Github Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this issue (detection ID 5006056) (Feedly).

1. Obtain or compromise the AES key: The attacker must know or obtain the AES key used by the target application (e.g., through credential theft, key leakage, or insider access), since the malicious payload must be validly encrypted to pass AES-GCM tag verification.
2. Craft a malicious pickle payload: Using Python, create a pickle payload that executes arbitrary code upon deserialization, e.g., using pickle.dumps() with a class implementing __reduce__ to run a shell command.
3. Encrypt the payload: Use cryptidy's aes_encrypt_message (or equivalent AES-GCM encryption) with the known key to produce a valid ciphertext containing the malicious pickle data, matching the expected nonce+tag+timestamp+ciphertext format.
4. Deliver the ciphertext: Supply the crafted encrypted message to the target application through any channel it accepts (e.g., network message, file, API call), causing it to invoke aes_decrypt_message or decrypt_message.
5. Trigger deserialization: When the application calls pickle.loads(data) on the decrypted output, the embedded payload executes arbitrary code with the application's privileges, achieving RCE (PoC Repo, cryptidy source).

• Process: Unexpected child processes spawned by the Python application using cryptidy (e.g., sh, bash, cmd.exe, calc.exe, curl, wget, python) immediately following a decryption operation.
• Logs: Application error logs containing cryptidy unpickle error or Cannot unpickle an object entries, which may indicate failed or probing deserialization attempts; unusual exceptions from aes_decrypt_message.
• File System: Presence of files named payload_malicioso.bin, payload_malicioso_cifrado.b64, ejecutar_exploit.py, or exploit_and_hunter.py on the system, which are artifacts from the public PoC (PoC Repo).
• Network: Unexpected outbound connections from the Python application process to unknown external IPs following decryption events, potentially indicating reverse shell or data exfiltration activity.

Upgrade cryptidy to a version beyond 1.2.4, which addresses this vulnerability by replacing or restricting the use of pickle.loads (Github Advisory). As an interim workaround, restrict the sources from which encrypted messages are accepted to trusted, authenticated parties only, and ensure AES keys are not exposed to untrusted parties. For applications that cannot upgrade immediately, consider replacing pickle-based serialization with a safe format such as JSON, or implement a restricted unpickler that whitelists permitted classes. Perform a code review of all applications using cryptidy ≤ 1.2.4 to identify all call sites of aes_decrypt_message or decrypt_message that may process externally supplied data (Feedly).

The GitHub Advisory Database published GHSA-97w9-v595-3h5q on October 31, 2025, rating the vulnerability as Moderate severity. Red Hat also tracked the issue under their CVE database. No significant public commentary from prominent security researchers or broad media coverage has been identified beyond the PoC repository and standard advisory publications (Github Advisory, Red Hat).