Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-58367

34
FAUCET Score

CVE-2025-58367 is a critical vulnerability affecting DeepDiff versions 5.0.0 through 8.6.0, allowing for class pollution via the Delta class constructor. This can lead to Denial of Service and Remote Code Execution through insecure Pickle deserialization, potentially enabling arbitrary Python code execution if user-controlled input is passed to Delta. With a CVSS score of 10.0, this vulnerability is highly severe, requiring no user interaction or privileges, and has a high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion, suggesting a low immediate threat but a high potential risk.

Impacted Technologies

VendorProductVersion(s)CPE
SepermanDeepdiff
>= 5.0.0, < 8.6.1CNA affected

CVSS Data

CVSS version used by this source: 4.0

10.0CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
HIGH
VS Integrity
HIGH
VS Availability
HIGH
SS Confidentiality
HIGH
SS Integrity
HIGH
SS Availability
HIGH
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
1.06%
Probability of exploitation in next 30 days
EPSS Percentile
60.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0106 is in the 46th percentile among its peer group of 36,897 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

pippatch availablevia ghsa
Product: deepdiffFixed in: 8.6.1

Vendor Advisories (1)

pipGHSA-mw26-5g2v-hqw3critical

DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more

Sep 3, 2025

References

github.com / seperman/deepdiff/commit/c69c06c13f75e849c770ade3f556cd16209fd183
github.com / seperman/deepdiff/releases/tag/8.6.1
github.com / seperman/deepdiff/security/advisories/GHSA-mw26-5g2v-hqw3