cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.
References
| Link | Resource |
|---|---|
| https://github.com/javiermorales36/cryptidy-analysis | Exploit Third Party Advisory |
| https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.py#L220-L238 | Product |
| https://github.com/javiermorales36/cryptidy-analysis | Exploit Third Party Advisory |
Configurations
History
08 Dec 2025, 13:24
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/javiermorales36/cryptidy-analysis - Exploit, Third Party Advisory | |
| References | () https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.py#L220-L238 - Product | |
| First Time |
Netinvent cryptidy
Netinvent |
|
| CPE | cpe:2.3:a:netinvent:cryptidy:*:*:*:*:*:python:*:* |
31 Oct 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/javiermorales36/cryptidy-analysis - |
31 Oct 2025, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-31 07:15
Updated : 2025-12-08 13:24
NVD link : CVE-2025-63675
Mitre link : CVE-2025-63675
CVE.ORG link : CVE-2025-63675
JSON object : View
Products Affected
netinvent
- cryptidy
CWE
CWE-502
Deserialization of Untrusted Data