{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.2.4"}],"component":"cryptidy","cve_ids":["CVE-2025-63675"],"ecosystem":"PyPI","epss":0.00252,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-97w9-v595-3h5q","id":"tcs_01M5KFA4K3RWV6EBCG4134WHM8","modified_at":"2026-07-07T17:57:21.311227474Z","published_at":"2025-10-31T09:30:25Z","references":["https://osv.dev/vulnerability/GHSA-97w9-v595-3h5q","https://nvd.nist.gov/vuln/detail/CVE-2025-63675","https://github.com/javiermorales36/cryptidy-analysis","https://github.com/netinvent/cryptidy","https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.py#L220-L238"],"severity":{"label":"medium","score":6.9},"sources":[{"source":"osv","source_id":"GHSA-97w9-v595-3h5q","url":"https://osv.dev/vulnerability/GHSA-97w9-v595-3h5q"}],"summary":"cryptidy allows code execution via untrusted data due to pickle.loads"}