ply-3.11-py2.py3-none-any.whl: 1 vulnerabilities (highest severity is: 9.8)

[mend-for-github-com]

Vulnerable Library - ply-3.11-py2.py3-none-any.whl

Python Lex & Yacc

Library home page: https://files.pythonhosted.org/packages/a3/58/35da89ee790598a0700ea49b2a66594140f44dec458c07e8e3d4979137fc/ply-3.11-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /tmp/ws-ua_20251126140837_YAOJPN/python_UBHLPJ/20251126140838/ply-3.11-py2.py3-none-any.whl

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (ply version)	Remediation Possible**
CVE-2025-56005	Critical	9.8	ply-3.11-py2.py3-none-any.whl	Direct	N/A	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2025-56005

Vulnerable Library - ply-3.11-py2.py3-none-any.whl

Python Lex & Yacc

Library home page: https://files.pythonhosted.org/packages/a3/58/35da89ee790598a0700ea49b2a66594140f44dec458c07e8e3d4979137fc/ply-3.11-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /tmp/ws-ua_20251126140837_YAOJPN/python_UBHLPJ/20251126140838/ply-3.11-py2.py3-none-any.whl

Dependency Hierarchy:

• ❌ ply-3.11-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the "picklefile" parameter in the "yacc()" function. This parameter accepts a ".pkl" file that is deserialized with "pickle.load()" without validation. Because "pickle" allows execution of embedded code via "reduce()", an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk.

Publish Date: 2026-01-20

URL: CVE-2025-56005

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.