CVE-2025-56005

Fixed in a distro release EPSS 19%CVSS 9.8

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code via `__reduce__()`, an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.

Published 2026-01-20 · CVE record · OSV

Products: Red Hat Fence Agents Remediation Operator, Red Hat Migration Toolkit for Containers, Red Hat Migration Toolkit for Virtualization, Red Hat OpenShift Developer Tools and Services, Red Hat OpenShift Pipelines, Red Hat OpenShift Service Mesh 2, Red Hat OpenShift Service Mesh 3, Red Hat Advanced Cluster Security 4, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Certification Program for Red Hat Enterprise Linux 9, Red Hat Directory Server 13, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4, Red Hat OpenShift GitOps, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0, Red Hat Quay 3, Red Hat Service Telemetry Framework 1.5

Distro releases