marsupialtail quokka up to 3.0.1 pyquokka/flight.py loads deserialization

Summaryinfo

A vulnerability, which was classified as critical, has been found in marsupialtail quokka up to 3.0.1. This issue affects the function loads of the file pyquokka/flight.py. Performing a manipulation results in deserialization. This vulnerability is cataloged as CVE-2025-62515. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical has been found in marsupialtail quokka up to 3.0.1. This affects the function loads of the file pyquokka/flight.py. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

pyquokka is a framework for making data lakes work for time series. In versions 0.3.1 and prior, the FlightServer class directly uses pickle.loads() to deserialize action bodies received from Flight clients without any sanitization or validation in the do_action() method. The vulnerable code is located in pyquokka/flight.py at line 283 where arbitrary data from Flight clients is directly passed to pickle.loads(). When FlightServer is configured to listen on 0.0.0.0, this allows attackers across the entire network to perform arbitrary remote code execution by sending malicious pickled payloads through the set_configs action. Additional vulnerability points exist in the cache_garbage_collect, do_put, and do_get functions where pickle.loads is used to deserialize untrusted remote data.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-62515 since 10/15/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/18/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• marsupialtail

Name

• quokka

Version

• 3.0.0
• 3.0.1

Website

• Product: https://github.com/marsupialtail/quokka/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion