CVE-2025-58367: DeepDiff RCE Vulnerability

CVE-2025-58367 Overview

CVE-2025-58367 is a critical class pollution vulnerability in DeepDiff, a Python library used for deep difference and search operations on Python data structures. The vulnerability exists in versions 5.0.0 through 8.6.0 and can be exploited through the Delta class constructor. When combined with an available gadget in DeltaDiff, this vulnerability can lead to Denial of Service and Remote Code Execution via insecure Pickle deserialization.

Critical Impact

This vulnerability allows attackers to modify deepdiff.serialization.SAFE_TO_IMPORT to permit dangerous classes such as posix.system, enabling arbitrary Python code execution through insecure Pickle deserialization when user-controlled input is passed to the Delta class.

Affected Products

• DeepDiff versions 5.0.0 through 8.6.0
• Python applications utilizing vulnerable DeepDiff versions with user-controlled Delta input
• Systems processing untrusted serialized data through DeepDiff

Discovery Timeline

• 2025-09-05 - CVE CVE-2025-58367 published to NVD
• 2025-09-08 - Last updated in NVD database

Technical Details for CVE-2025-58367

Vulnerability Analysis

This vulnerability represents a class pollution attack chain that ultimately leads to Remote Code Execution. The flaw resides in how the Delta class constructor handles input, allowing attackers to manipulate internal class attributes. The exploitation chain involves two key components: first, polluting the deepdiff.serialization.SAFE_TO_IMPORT allowlist to include dangerous system classes, and second, leveraging insecure Pickle deserialization to execute arbitrary code.

The attack is particularly dangerous because Pickle deserialization in Python inherently executes code during the unpickling process. By modifying the SAFE_TO_IMPORT list, an attacker bypasses the security controls designed to prevent dangerous classes from being deserialized. Classes like posix.system can then be instantiated with arbitrary command arguments, granting full system command execution.

Root Cause

The root cause is CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes. The Delta class constructor fails to properly sanitize or validate input parameters, allowing malicious actors to modify class-level attributes that control serialization security. This class pollution vulnerability, combined with the permissive nature of Python's Pickle deserialization, creates a critical attack surface. The SAFE_TO_IMPORT mechanism was designed as a security control, but its mutable nature through polluted input negates this protection entirely.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can craft malicious input that, when processed by the Delta class constructor, pollutes the SAFE_TO_IMPORT attribute to include dangerous callable objects. The attack proceeds as follows:

1. The attacker sends crafted input to an application endpoint that passes data to DeepDiff's Delta class
2. The class pollution gadget modifies deepdiff.serialization.SAFE_TO_IMPORT to whitelist dangerous classes like posix.system
3. A subsequent Pickle deserialization operation instantiates the dangerous class
4. Arbitrary Python code executes with the privileges of the application process

This vulnerability is exploitable in any application that accepts user-controlled input and passes it to the Delta class. The technical details and proof-of-concept information are available in the GitHub Security Advisory GHSA-mw26-5g2v-hqw3.

Detection Methods for CVE-2025-58367

Indicators of Compromise

• Unexpected modifications to deepdiff.serialization.SAFE_TO_IMPORT at runtime
• Pickle deserialization events involving system command classes such as posix.system or os.system
• Unusual subprocess spawning from Python processes running DeepDiff-dependent applications
• Error logs indicating failed deserialization of unexpected class types

Detection Strategies

• Monitor Python application logs for unusual Delta class instantiation patterns with complex nested objects
• Implement runtime integrity checking for the SAFE_TO_IMPORT module attribute
• Deploy application-level intrusion detection to flag suspicious Pickle deserialization attempts
• Use static code analysis tools to identify DeepDiff version usage and potential vulnerable code paths

Monitoring Recommendations

• Enable verbose logging for applications utilizing DeepDiff to capture Delta class operations
• Implement process monitoring to detect unexpected child processes spawned from Python applications
• Monitor network traffic for serialized Python objects being sent to vulnerable endpoints
• Configure SentinelOne Singularity platform to detect behavioral indicators of Pickle-based code execution

How to Mitigate CVE-2025-58367

Immediate Actions Required

• Upgrade DeepDiff to version 8.6.1 or later immediately
• Audit all applications using DeepDiff to identify user-controlled input paths to the Delta class
• Implement input validation and sanitization for any data passed to DeepDiff Delta operations
• Consider temporarily disabling Delta functionality if upgrade is not immediately possible

Patch Information

The vulnerability has been fixed in DeepDiff version 8.6.1. The security patch addresses the class pollution vulnerability in the Delta class constructor by implementing proper input validation and protecting the SAFE_TO_IMPORT attribute from unauthorized modification. The fix is available via the GitHub Release Version 8.6.1 and the specific code changes can be reviewed in the GitHub Commit.

Workarounds

• Avoid passing untrusted or user-controlled input to the Delta class constructor
• Implement application-level sandboxing for processes utilizing DeepDiff
• Deploy network segmentation to limit the impact of potential code execution
• Use a web application firewall (WAF) to filter potentially malicious serialized payloads

# Upgrade DeepDiff to patched version
pip install --upgrade deepdiff>=8.6.1

# Verify installed version
pip show deepdiff | grep Version

# For requirements.txt, update the dependency
# deepdiff>=8.6.1