Dabeaz PLY 3.11
Approved changes feed: RSS · Atom
cpe:2.3:a:dabeaz:ply:3.11:*:*:*:*:*:*:*part: a version: 3.11 update: *
| Vendor | Dabeaz (5e881145-428d-5af9-ae25-42be79c0def8) |
|---|---|
| Product | Ply (318bd61e-a2e7-5a55-89dc-c92b43eb0b9e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/dabeaz/ply |
purl2cpe | 2026-07-28 16:41:09.096998 |
pkg:pypi/ply |
purl2cpe | 2026-07-28 16:41:09.097001 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-56005 |
vulnerable | 2026-06-08 07:33:15.414847 |
Details available
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code via `__reduce__()`, an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.
Published: 2026-01-20T00:00:00.000Z
Updated: 2026-09-17T12:04:32.797Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.