seperman deepdiff up to 8.6.0 posix.system dynamically-determined object attributes

Summaryinfo

A vulnerability was found in seperman deepdiff up to 8.6.0. It has been rated as critical. Affected is an unknown function in the library posix.system. Performing a manipulation results in dynamically-determined object attributes. This vulnerability is cataloged as CVE-2025-58367. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in seperman deepdiff up to 8.6.0. This affects an unknown function in the library posix.system. The manipulation with an unknown input leads to a dynamically-determined object attributes vulnerability. CWE is classifying the issue as CWE-915. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are vulnerable to class pollution via the Delta class constructor, and when combined with a gadget available in DeltaDiff, it can lead to Denial of Service and Remote Code Execution (via insecure Pickle deserialization) exploitation. The gadget available in DeepDiff allows `deepdiff.serialization.SAFE_TO_IMPORT` to be modified to allow dangerous classes such as posix.system, and then perform insecure Pickle deserialization via the Delta class. This potentially allows any Python code to be executed, given that the input to Delta is user-controlled. Depending on the application where DeepDiff is used, this can also lead to other vulnerabilities. This is fixed in version 8.6.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-58367 since 08/29/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 264513 (openSUSE 15 Security Update : python-deepdiff (SUSE-SU-2025:03127-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 8.6.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch c69c06c13f75e849c770ade3f556cd16209fd183 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (264513) and EUVD (EUVD-2025-27049). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• seperman

Name

• deepdiff

Version

• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5
• 8.6.0

License

• open-source

Website

• Product: https://github.com/seperman/deepdiff/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion