PyPI/deepdiff CVE-2025-58367: critical, EPSS 1.19%
DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more
Action: Upgrade deepdiff to 8.6.1 or later.
pip install deepdiff==8.6.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0 | 8.6.1 | - |
Fixed versions
| 8.6.1 |
Sources
- osv: GHSA-mw26-5g2v-hqw3
- https://github.com/seperman/deepdiff/security/advisories/GHSA-mw26-5g2v-hqw3
- https://nvd.nist.gov/vuln/detail/CVE-2025-58367
- https://github.com/dgilland/pydash/issues/180
- https://github.com/dgilland/pydash/commit/2015f0a4bcdbc3a5b27652e38fe97b3ee13ac15f
- https://github.com/seperman/deepdiff/commit/c69c06c13f75e849c770ade3f556cd16209fd183
- https://github.com/seperman/deepdiff
- https://github.com/seperman/deepdiff/releases/tag/8.6.1
CVE-2025-58367 · published · modified · JSON