id: PYSEC-2026-1282
published: "2026-07-07T16:03:09.298310Z"
modified: "2026-07-07T17:23:58.526259Z"
aliases:
- CVE-2025-63675
- GHSA-97w9-v595-3h5q
summary: "cryptidy allows code execution via untrusted data due to pickle.loads "
details: cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.
affected:
- package:
    name: cryptidy
    ecosystem: PyPI
    purl: pkg:pypi/cryptidy
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - last_affected: 1.2.4
  versions:
  - 1.0.5
  - 1.0.7
  - 1.1.0
  - 1.2.0
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 1.2.4
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2025-63675
- type: WEB
  url: https://github.com/javiermorales36/cryptidy-analysis
- type: PACKAGE
  url: https://github.com/netinvent/cryptidy
- type: WEB
  url: "https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.py#L220-L238"
- type: PACKAGE
  url: https://pypi.org/project/cryptidy
- type: ADVISORY
  url: https://github.com/advisories/GHSA-97w9-v595-3h5q
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L