CVE-2025-56005: Dabeaz Ply RCE Vulnerability

CVE-2025-56005 Overview

CVE-2025-56005 is a critical insecure deserialization vulnerability affecting the PLY (Python Lex-Yacc) library version 3.11. The vulnerability exists in an undocumented picklefile parameter within the yacc() function, which accepts a .pkl file that is deserialized using Python's pickle.load() without proper validation. Since Python's pickle module allows execution of embedded code via the __reduce__() method, an attacker can achieve Remote Code Execution (RCE) by supplying a malicious pickle file.

This vulnerability is particularly concerning because the vulnerable parameter is not mentioned in official documentation or the GitHub repository, yet remains active in the PyPI version of the library. This creates a stealthy backdoor and persistence risk for applications using PLY.

Critical Impact
Remote Code Execution via unsafe pickle deserialization in an undocumented feature, allowing attackers to execute arbitrary code on systems running affected PLY library versions. Note that the validity of this CVE is disputed, with third parties questioning whether the proof of concept successfully demonstrates arbitrary code execution.

Affected Products

Dabeaz PLY version 3.11
Applications and tools using PLY 3.11 for lexing and parsing operations
Python projects with PLY 3.11 as a dependency

Discovery Timeline

2026-01-20 - CVE CVE-2025-56005 published to NVD
2026-02-06 - Last updated in NVD database

Technical Details for CVE-2025-56005

Vulnerability Analysis

The vulnerability stems from unsafe use of Python's pickle serialization module within the PLY library's parser generation functionality. The yacc() function in PLY includes an undocumented picklefile parameter that allows users to specify a .pkl file path. When provided, this file is loaded and deserialized using pickle.load() without any validation or sanitization of the file contents.

Python's pickle module is inherently unsafe for deserializing untrusted data because pickled objects can define a __reduce__() method that specifies arbitrary code to execute during unpickling. This means any application that calls yacc() with a user-controlled or externally-provided pickle file path becomes vulnerable to code execution.

The lack of documentation for this parameter adds an additional layer of concern, as developers may be unaware of this attack surface. Security teams auditing PLY-dependent applications would have difficulty identifying this risk without inspecting the library's source code directly.

Root Cause

The root cause is the unsafe deserialization of pickle data (CWE-502: Deserialization of Untrusted Data). The PLY library directly uses pickle.load() to deserialize parser table data from user-specified file paths without implementing any safeguards such as cryptographic integrity verification, allowlist-based object filtering, or using safer serialization alternatives.

Attack Vector

The attack can be executed over the network in scenarios where:

An application using PLY allows external input to influence the picklefile parameter path
An attacker can place a malicious pickle file on a path accessible to the target application
File upload functionality exists that could be leveraged to plant the malicious pickle file

The exploitation process involves crafting a malicious pickle file that, when deserialized, invokes the __reduce__() method to execute attacker-controlled commands. Once the application calls yacc() with the path to this malicious file, arbitrary code execution occurs with the privileges of the running process.

For technical analysis of the vulnerability mechanism, refer to the GitHub PoC Repository and Openwall OSS Security discussions for detailed information. Note that the validity of this vulnerability is disputed by third parties, as documented in the ply exploit rejection repository.

Detection Methods for CVE-2025-56005

Indicators of Compromise

Unexpected .pkl files appearing in application directories or temporary folders
Process spawning or network connections originating from Python applications using PLY
Unusual file access patterns to pickle files by Python processes
System modifications or persistence mechanisms established after PLY library operations

Detection Strategies

Monitor for calls to yacc() function with the picklefile parameter in application logs
Implement file integrity monitoring on directories where PLY parser tables may be stored
Analyze Python application behavior for unexpected subprocess creation or network activity
Deploy endpoint detection to identify pickle deserialization followed by suspicious command execution

Monitoring Recommendations

Enable logging for file operations targeting .pkl files in application directories
Configure alerts for unusual process chains originating from Python interpreters
Implement application-level monitoring for PLY library function calls with external file parameters
Review dependency chains to identify all applications using PLY 3.11

How to Mitigate CVE-2025-56005

Immediate Actions Required

Audit all applications using PLY library to identify usage of the picklefile parameter
Ensure no user-controlled input can influence file paths passed to yacc()
Consider removing or replacing PLY 3.11 in production environments until a patched version is available
Implement strict file path validation if pickle file parameters must be used

Patch Information

As of the last update on 2026-02-06, no official patch has been released for this vulnerability. Organizations should monitor the Dabeaz PLY GitHub repository and PyPI for security updates. Note that the validity of this CVE is disputed, and users should review the GitHub Issue Tracker and Openwall security discussions for the latest information on this dispute.

Workarounds

Avoid using the picklefile parameter in yacc() calls entirely
If pickle files must be used, ensure they are generated locally and protected with strict file permissions
Implement input validation to reject any external or user-controlled file paths for parser operations
Consider using alternative parsing libraries that do not rely on pickle serialization

bash

# Verify PLY version in your environment
pip show ply | grep -E "^(Name|Version):"

# Search for potentially vulnerable yacc() calls with picklefile parameter
grep -r "yacc.*picklefile" --include="*.py" /path/to/application

# Check for suspicious .pkl files in common directories
find /var/www /opt /home -name "*.pkl" -type f -ls 2>/dev/null