Vulnerable Library - ply-3.11-py2.py3-none-any.whl

Python Lex & Yacc

Library home page: https://files.pythonhosted.org/packages/a3/58/35da89ee790598a0700ea49b2a66594140f44dec458c07e8e3d4979137fc/ply-3.11-py2.py3-none-any.whl

Path to dependency file: /devel/py-stone/files/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260411033423_DDAOZB/python_HIHPOV/202604110335061/env/lib/python3.9/site-packages/ply-3.11.dist-info

Dependency Hierarchy:

• ❌ ply-3.11-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 25cf57a93f385839bd7e68424038ff713426e4e9

Found in base branch: master

Vulnerability Details

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the "picklefile" parameter in the "yacc()" function. This parameter accepts a ".pkl" file that is deserialized with "pickle.load()" without validation. Because "pickle" allows execution of embedded code via "reduce()", an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.

Publish Date: 2026-01-20

URL: CVE-2025-56005

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High