CVE-2025-56005

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-56005
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code via `__reduce__()`, an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/bohmiiidd/Undocumented-RCE-in-PLY Exploit Third Party Advisory
https://github.com/bohmiiidd/Undocumument_RCE_PLY-yacc-CVE-2025-56005 Exploit Third Party Advisory
https://github.com/tom025/ply_exploit_rejection Exploit Mitigation Third Party Advisory
https://github.com/tom025/ply_exploit_rejection/issues/1
http://www.openwall.com/lists/oss-security/2026/01/23/4 Exploit Mailing List
http://www.openwall.com/lists/oss-security/2026/01/23/5 Mailing List
http://www.openwall.com/lists/oss-security/2026/01/28/5 Exploit Mailing List
http://www.openwall.com/lists/oss-security/2026/01/29/1 Exploit Mailing List
http://www.openwall.com/lists/oss-security/2026/01/29/2 Mailing List
http://www.openwall.com/lists/oss-security/2026/01/30/1
https://access.redhat.com/security/cve/CVE-2025-56005
https://bugzilla.redhat.com/show_bug.cgi?id=2431308
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-56005.json
Configurations

Configuration 1 (hide)

cpe:2.3:a:dabeaz:ply:3.11:*:*:*:*:*:*:*
History

30 Jun 2026, 03:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/security/cve/CVE-2025-56005 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2431308 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-56005.json -

17 Jun 2026, 09:42

Type Values Removed Values Added
Summary
  • (es) Una característica indocumentada e insegura en la librería PLY (Python Lex-Yacc) 3.11 permite la ejecución remota de código (RCE) a través del parámetro 'picklefile' en la función 'yacc()'. Este parámetro acepta un archivo .pkl que se deserializa con 'pickle.load()' sin validación. Debido a que 'pickle' permite la ejecución de código incrustado a través de '__reduce__()', un atacante puede lograr la ejecución de código pasando un archivo pickle malicioso. El parámetro no se menciona en la documentación oficial ni en el repositorio de GitHub, sin embargo, está activo en la versión de PyPI. Esto introduce una puerta trasera sigilosa y un riesgo de persistencia. NOTA: Un tercero afirma que esta vulnerabilidad debería ser rechazada porque la prueba de concepto no demuestra la ejecución de código arbitrario y no se completa con éxito.

06 Feb 2026, 20:16

Type Values Removed Values Added
Summary (en) An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code via `__reduce__()`, an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. (en) An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code via `__reduce__()`, an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.
References
  • () https://github.com/tom025/ply_exploit_rejection/issues/1 -

30 Jan 2026, 23:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/01/30/1 -
References () https://github.com/tom025/ply_exploit_rejection - Exploit, Third Party Advisory, Mitigation () https://github.com/tom025/ply_exploit_rejection - Exploit, Mitigation, Third Party Advisory

30 Jan 2026, 20:05

Type Values Removed Values Added
First Time Dabeaz
Dabeaz ply
References () https://github.com/bohmiiidd/Undocumented-RCE-in-PLY - () https://github.com/bohmiiidd/Undocumented-RCE-in-PLY - Exploit, Third Party Advisory
References () https://github.com/bohmiiidd/Undocumument_RCE_PLY-yacc-CVE-2025-56005 - () https://github.com/bohmiiidd/Undocumument_RCE_PLY-yacc-CVE-2025-56005 - Exploit, Third Party Advisory
References () https://github.com/tom025/ply_exploit_rejection - () https://github.com/tom025/ply_exploit_rejection - Exploit, Third Party Advisory, Mitigation
References () http://www.openwall.com/lists/oss-security/2026/01/23/4 - () http://www.openwall.com/lists/oss-security/2026/01/23/4 - Exploit, Mailing List
References () http://www.openwall.com/lists/oss-security/2026/01/23/5 - () http://www.openwall.com/lists/oss-security/2026/01/23/5 - Mailing List
References () http://www.openwall.com/lists/oss-security/2026/01/28/5 - () http://www.openwall.com/lists/oss-security/2026/01/28/5 - Exploit, Mailing List
References () http://www.openwall.com/lists/oss-security/2026/01/29/1 - () http://www.openwall.com/lists/oss-security/2026/01/29/1 - Exploit, Mailing List
References () http://www.openwall.com/lists/oss-security/2026/01/29/2 - () http://www.openwall.com/lists/oss-security/2026/01/29/2 - Mailing List
CPE cpe:2.3:a:dabeaz:ply:3.11:*:*:*:*:*:*:*

29 Jan 2026, 20:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/01/29/2 -

29 Jan 2026, 19:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/01/29/1 -

29 Jan 2026, 00:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/01/28/5 -

28 Jan 2026, 21:16

Type Values Removed Values Added
References
  • () https://github.com/bohmiiidd/Undocumument_RCE_PLY-yacc-CVE-2025-56005 -

28 Jan 2026, 07:15

Type Values Removed Values Added
References
  • () https://github.com/tom025/ply_exploit_rejection -

23 Jan 2026, 22:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/01/23/5 -

23 Jan 2026, 21:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/01/23/4 -

20 Jan 2026, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-20 19:15

Updated : 2026-07-20 12:17

NVD link : CVE-2025-56005

Mitre link : CVE-2025-56005

CVE.ORG link : CVE-2025-56005

JSON object : View

Products Affected

dabeaz

  • ply
CWE
CWE-502

Deserialization of Untrusted Data