CVE-2025-55136: ERC Insecure Deserialization Vulnerability

CVE-2025-55136 Overview

CVE-2025-55136 is an insecure deserialization vulnerability affecting the ERC (Emotion Recognition in Conversation) project through version 0.3. The flaw stems from the use of jsonpickle to deserialize serialized objects without validation. An attacker with local access can craft a malicious serialized object that executes arbitrary Python code when the application loads it. The issue is tracked under CWE-502: Deserialization of Untrusted Data.

Critical Impact
A local attacker who supplies a crafted jsonpickle payload can trigger object instantiation that leads to code execution in the context of the ERC process, compromising confidentiality and integrity of the affected system.

Affected Products

ERC (Emotion Recognition in Conversation) versions through 0.3
Applications that import and deserialize ERC-produced objects via jsonpickle
Downstream research pipelines that reuse ERC serialization utilities

Discovery Timeline

2025-08-07 - CVE-2025-55136 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55136

Vulnerability Analysis

The ERC project uses jsonpickle to serialize and reconstruct Python objects. jsonpickle allows arbitrary class instantiation during decoding based on type metadata embedded in the JSON payload. When ERC loads a serialized object from an untrusted source, jsonpickle resolves the embedded class references and invokes constructors or __reduce__-style handlers. This behavior allows an attacker to reference callable classes already present in the Python environment and pass attacker-controlled arguments during reconstruction. The attack requires local access to the deserialization input path, which limits scope but still permits code execution or file manipulation with the privileges of the ERC process.

Root Cause

The root cause is unsafe use of jsonpickle.decode() on untrusted input. jsonpickle is documented as unsafe for untrusted data because it treats serialized type information as authoritative. ERC does not restrict allowable classes, sanitize the input, or use a schema-constrained loader before deserialization.

Attack Vector

An attacker crafts a jsonpickle payload that references a Python class capable of executing code during instantiation. The attacker places the payload where ERC will load it, such as a cached model artifact, an experiment configuration, or a shared dataset file. When ERC calls jsonpickle.decode(), the malicious object is materialized and the payload runs.

The vulnerability mechanism is described in the ERC GitHub Pull Request Discussion. No public proof-of-concept exploit code has been verified.

Detection Methods for CVE-2025-55136

Indicators of Compromise

Presence of py/object or py/reduce keys inside JSON files loaded by ERC workflows, which indicate jsonpickle type metadata
Unexpected child processes spawned by the Python interpreter running ERC scripts
Modification of ERC configuration or cache files by non-standard users or processes

Detection Strategies

Scan repositories and data directories for serialized files containing jsonpickle class references pointing to modules outside the ERC namespace
Instrument Python processes to log calls to jsonpickle.decode with source path attribution
Correlate deserialization events with subsequent file writes, network connections, or subprocess creation

Monitoring Recommendations

Monitor endpoint telemetry for Python processes executing shell commands or writing to sensitive paths shortly after loading .json artifacts
Track file integrity on ERC model, cache, and configuration directories
Alert on new outbound connections initiated by ERC training or inference processes

How to Mitigate CVE-2025-55136

Immediate Actions Required

Stop loading jsonpickle payloads from any source that is not fully trusted and integrity-verified
Restrict filesystem permissions on ERC configuration and cache directories to prevent local tampering
Audit existing serialized artifacts for suspicious class references before reuse

Patch Information

As of the last NVD update, no fixed release has been identified in the enriched data. Track remediation progress and proposed fixes in the upstream pull request. Replace jsonpickle with a safer serialization format such as JSON with an explicit schema, or use jsonpickle with a restricted classes allowlist.

Workarounds

Replace jsonpickle.decode() with json.loads() and reconstruct objects using explicit, validated factories
If jsonpickle must be retained, pass a restricted classes parameter that limits deserialization to a known-safe allowlist
Run ERC in an isolated environment such as a dedicated container or sandboxed user account to contain the blast radius of successful exploitation

bash

# Configuration example: restrict jsonpickle to an allowlist of safe classes
python - <<'EOF'
import jsonpickle
from erc.models import SafeConfig  # only classes you trust

with open('artifact.json') as f:
    data = f.read()

obj = jsonpickle.decode(data, classes=[SafeConfig], safe=True)
EOF