An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code via `__reduce__()`, an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk.
Metrics
Affected Vendors & Products
References
History
Thu, 22 Jan 2026 12:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | ply: From CVEorg collector | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Wed, 21 Jan 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Python
Python ply |
|
| Vendors & Products |
Python
Python ply |
Tue, 20 Jan 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 20 Jan 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-502 | |
| Metrics |
cvssV3_1
|
Tue, 20 Jan 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code via `__reduce__()`, an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. | |
| References |
|
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2026-01-20T18:49:29.501Z
Reserved: 2025-08-16T00:00:00.000Z
Link: CVE-2025-56005
Updated: 2026-01-20T18:48:39.836Z
Status : Received
Published: 2026-01-20T19:15:49.247
Modified: 2026-01-20T19:15:49.247
Link: CVE-2025-56005