{"data":{"id":"2dcf8a20-f1dc-4b2e-89ac-4f797cf6cad3","title":"CVE-2025-62703: Fugue is a unified interface for distributed computing that lets users execute Python, Pandas, and SQL code on Spark…","summary":"CVE-2025-62703 affects Fugue, a unified distributed computing interface, in version 0.9.2 and prior. The _decode() function in fugue/rpc/flask.py passes data directly to cloudpickle.loads() without sanitization in the FlaskRPCServer, so a client can send serialized Python objects that the server deserializes, allowing arbitrary code execution on the server host.","solution":"This issue has been patched via commit 6f25326.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-62703","publishedAt":"2025-11-26T03:15:47.693Z","cveId":"CVE-2025-62703","cweIds":["CWE-502"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["fugue@<= 0.9.2"],"affectedPackageNames":["fugue"],"affectedPackageRefs":["pypi:fugue"],"affectedVendors":[],"affectedVendorsRaw":["Fugue"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Fugue remote code execution through pickle deserialization in FlaskRPCServer","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00784,"epssCheckedAt":"2026-11-04T00:12:27.710Z","kevDateAdded":null,"advisoryAliases":["GHSA-xv5p-fjw5-vrj6"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:54.444Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}