CVE-2026-25632

CVE-2026-25632 is a critical deserialization vulnerability in EPyT-Flow, a Python package for water distribution network data generation, affecting versions prior to 0.16.1. Its REST API and JSON file loading mechanism improperly handle attacker-controlled JSON request bodies, allowing dynamic module/class instantiation with arbitrary arguments. This allows for OS command execution, potentially leading to full system compromise. With a CVSS score of 10.0 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity and no user interaction, resulting in complete confidentiality, integrity, and availability compromise. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion, and it is not listed on the CISA KEV catalog.