CVE-2026-25632: EPyT-Flow REST API Unsafe Deserialization Leading to OS Command Execution (CWE-502)
CVE-2026-25632 affects EPyT-Flow versions prior to 0.16.1. Its REST API uses a custom JSON deserializer that can dynamically import and instantiate attacker-chosen classes, which the advisory says can lead to OS command execution during JSON parsing. The record rates it critical (CVSS 3.1 base score 10) and states it is fixed in 0.16.1.
Overview
EPyT-Flow is a Python package for generating hydraulic and water quality scenario data for water distribution networks. Its REST API parses JSON request bodies with a custom deserializer that honours a type field, and the advisory describes this as enabling dynamic import and instantiation of attacker-chosen classes. The weakness is classified as CWE-502, Deserialization of Untrusted Data. The vendor-linked patch is part of release 0.16.1.
Impact
The record states that the flaw can lead to operating system command execution while JSON is being parsed, and that loading JSON files is also affected. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which describes network exploitation without privileges or user interaction and high impact to confidentiality, integrity and availability. Because the scope is marked as changed, the impact may extend beyond the vulnerable component.
Affected products and versions
- Product: Waterfutures Epyt-flow (EPyT-Flow).
- Affected: versions prior to 0.16.1, according to the affected-version data in the record.
- Fixed: version 0.16.1, per the record description and the release reference.
Exploitation status
The CISA KEV catalogue entry in the record is marked as not listed. No confirmed exploitation in the wild appears in the sources consulted for this analysis. The EPSS data in the record gives a probability of 0.01423 with a percentile of 0.72206, which is a statistical estimate and not evidence of exploitation.
Remediation and mitigation
- Upgrade EPyT-Flow to version 0.16.1 or later, which the record identifies as the fixed release.
- Review the vendor advisory and release notes for any additional operational guidance.
- Until the upgrade is complete, limit network exposure of the REST API to trusted clients and restrict who can submit JSON input or JSON files to the application.
- Treat JSON files and request bodies from untrusted sources as hostile input, and run the service with the least privilege practical.
Detection guidance
- Review web and application logs for unusual JSON request bodies that include type fields or unexpected module or class references.
- Monitor the service host for child processes spawned by the EPyT-Flow Python process that are unrelated to normal scenario work.
- Audit the installed EPyT-Flow version across environments to confirm that no instance runs a version earlier than 0.16.1.
Limitations of the available information
The record does not describe the exact request format, the full set of exposed classes, or any proof-of-concept details, and this analysis does not provide them. Whether a given deployment is reachable from untrusted networks is unknown from the record. Exploitation status is limited to the KEV and EPSS data present in the record.
Frequently asked questions
What is CVE-2026-25632?
It is a critical deserialization weakness (CWE-502) in EPyT-Flow versions before 0.16.1, where the REST API's JSON parser can dynamically instantiate attacker-chosen classes. The record says this can lead to OS command execution during JSON parsing.
Which version fixes the issue?
The record states that the vulnerability is fixed in EPyT-Flow 0.16.1, and links to a commit and release tag for that version.
Is this vulnerability known to be actively exploited?
No. The CISA KEV entry in the record is not listed, and no confirmed exploitation appears in the sources consulted for this analysis.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.