CVE-2025-61765: python-socketio Pickle RCE Vulnerability

CVE-2025-61765 Overview

CVE-2025-61765 is an insecure deserialization vulnerability in python-socketio versions prior to 5.14.0. The flaw affects multi-server Socket.IO deployments that use a message queue backend such as Redis for inter-server communication. Messages exchanged between servers are encoded with Python's pickle module and deserialized without validation using pickle.loads(). An attacker who has already gained access to the message queue can send a crafted pickle payload that triggers arbitrary code execution during deserialization through Python's __reduce__ method. Single-server deployments and multi-server deployments with a properly secured message queue are not affected.

Critical Impact
Attackers with message queue access can execute arbitrary Python code in the context of Socket.IO server processes, gaining the privileges of those processes across all connected nodes.

Affected Products

python-socketio versions prior to 5.14.0
Multi-server Socket.IO deployments using Redis or similar message queue backends
async_aiopika_manager and other AsyncPubSubManager-derived managers

Discovery Timeline

2025-10-06 - CVE-2025-61765 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61765

Vulnerability Analysis

The vulnerability is classified under [CWE-502: Deserialization of Untrusted Data]. python-socketio supports horizontal scaling by exchanging inter-process messages through a shared message queue such as Redis, Kombu, or aio-pika. Before version 5.14.0, the library serialized these messages with Python's pickle module and deserialized incoming messages using pickle.loads() on the assumption that the queue was trusted.

An attacker who obtains write access to the message queue can publish a malicious pickle object to the Socket.IO channel. When any subscribed server consumes the message, pickle.loads() invokes the object's __reduce__ method, which can return an arbitrary callable and arguments. This results in code execution inside the Socket.IO worker process.

The attack requires prior compromise of the queue, which is why the CVSS vector is scoped to Adjacent Network access with High privileges required. Impact on affected servers includes full code execution, data theft, and lateral movement to other application components that share the same infrastructure.

Root Cause

The root cause is the use of pickle as the wire format for inter-server messaging in the PubSubManager family of classes. pickle is not a safe deserialization format when the input is attacker-controlled, because it permits execution of arbitrary constructors and callables during object reconstruction.

Attack Vector

Exploitation requires network access to the shared message queue and sufficient privileges to publish messages on the Socket.IO channel. Once the attacker publishes a crafted pickle payload, every subscribed server that consumes the message executes the embedded payload. The following patch excerpt shows the library switching from pickle to json for the aio-pika manager:

python

 import asyncio
-import pickle
 
+from engineio import json
 from .async_pubsub_manager import AsyncPubSubManager
 
 try:

Source: GitHub commit 53f6be0

A proof-of-concept demonstrating pickle payload delivery through a compromised Redis backend is published at locus-x64/CVE-2025-61765_PoC.

Detection Methods for CVE-2025-61765

Indicators of Compromise

Unexpected child processes spawned by Socket.IO worker processes such as shells, python, or network utilities.
Outbound network connections from Socket.IO servers to unfamiliar destinations shortly after message queue activity.
Anomalous PUBLISH commands on Redis channels used by Socket.IO (for example flask-socketio or a custom channel name) originating from non-application clients.
Message payloads on the Socket.IO channel that begin with pickle opcodes (\\x80\\x04 or similar) rather than JSON structures on patched deployments.

Detection Strategies

Inventory running Python environments and identify installations of python-socketio below version 5.14.0.
Monitor Redis, RabbitMQ, or Kafka broker access logs for authentication from unexpected source addresses or accounts.
Enable Redis MONITOR or slowlog sampling in non-production environments to observe channel publishers and validate that only Socket.IO servers publish to the shared channel.
Correlate process execution telemetry from Socket.IO hosts with message queue publish events to identify deserialization-triggered execution.

Monitoring Recommendations

Alert on new external listeners or command-and-control patterns emerging from application server hosts running Socket.IO.
Track message queue authentication failures and configuration changes, particularly disabled authentication or bind-address changes.
Log and review changes to Socket.IO application dependencies, including python-socketio version pins in requirements.txt or pyproject.toml.

How to Mitigate CVE-2025-61765

Immediate Actions Required

Upgrade python-socketio to version 5.14.0 or later, which replaces pickle with json for inter-server messaging.
Restrict message queue network exposure so that only Socket.IO servers can connect, using localhost binding for single-node deployments and private networks for multi-node deployments.
Enforce authentication and TLS encryption on the message queue backend (Redis, RabbitMQ, Kafka).
Rotate any message queue credentials that may have been exposed on public interfaces.

Patch Information

The fix is applied in commit 53f6be0 and documented in the GitHub Security Advisory GHSA-g8c6-8fjj-2r4m. The patch removes the pickle import from the PubSubManager implementations and replaces pickle.dumps/pickle.loads with json.dumps/json.loads from engineio.json. Additional analysis is available in the BlueRock research writeup.

Workarounds

Bind Redis or other message queue services to localhost when the Socket.IO deployment runs on a single node.
Deploy multi-node Socket.IO clusters inside a private network or VPC that is not reachable from the internet.
Require authenticated connections and enable transport encryption on all message queue clients and servers.
Segment application infrastructure so that a compromise of one service cannot reach the Socket.IO message queue.

bash

# Upgrade python-socketio to the patched version
pip install --upgrade 'python-socketio>=5.14.0'

# Example Redis hardening: bind to localhost and require authentication
# /etc/redis/redis.conf
bind 127.0.0.1
requirepass <strong-random-secret>
protected-mode yes