CVE-2025-56005
The PLY library version 3.11 contains an undocumented feature that lets an attacker run arbitrary code by supplying a malicious pickle file to the `yacc()` function. The library deserializes the file without validation, allowing code execution via pickle’s `__reduce__()` method. This flaw could let attackers take full control of any system that uses the library.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
PLY (Python Lex-Yacc) library, version 3.11, as distributed on PyPI.
Real-world impact
An attacker could execute any code on a system that loads a malicious pickle file through the vulnerable `yacc()` function, potentially compromising confidentiality, integrity, and availability.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is network‑exploitable with no authentication or user interaction, and it can fully compromise the affected system’s confidentiality, integrity, and availability.
What to do about it
- ›Avoid using the `picklefile` parameter in `yacc()`; if you must use it, ensure the pickle file comes from a trusted source and is not tampered with.
- ›Consider upgrading to a newer version of PLY once a patch is released.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jan 20, 2026 · Jan 20, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 16d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- github.com/bohmiiidd/Undocumented-RCE-…exploitthird party advisory
- github.com/bohmiiidd/Undocumument_RCE_…exploitthird party advisory
- github.com/tom025/ply_exploit_rejectio…exploitmitigationthird party advisory
- github.com/tom025/ply_exploit_rejectio…
- openwall.com/lists/oss-security/2026/01/…exploitmailing list
- openwall.com/lists/oss-security/2026/01/…mailing list
- openwall.com/lists/oss-security/2026/01/…exploitmailing list
- openwall.com/lists/oss-security/2026/01/…exploitmailing list
- openwall.com/lists/oss-security/2026/01/…mailing list
- openwall.com/lists/oss-security/2026/01/…
- access.redhat.com/security/cve/CVE-2025-56005
- bugzilla.redhat.com/show_bug.cgi
- security.access.redhat.com/data/csaf/v2/vex/2025/cve-2…