{"action":"Upgrade python-socketio to 5.14.0 or later.","affected":[{"fixed":"5.14.0","introduced":"0.8.0"}],"component":"python-socketio","cve_ids":["CVE-2025-61765"],"ecosystem":"PyPI","epss":0.00482,"exploited":false,"fixed_versions":["5.14.0"],"ghsa_id":"GHSA-g8c6-8fjj-2r4m","id":"tcs_01M5KFH5XBBND6EPSXY76AWCJJ","modified_at":"2026-09-10T03:50:29.882047738Z","published_at":"2025-10-07T12:55:22Z","references":["https://osv.dev/vulnerability/GHSA-g8c6-8fjj-2r4m","https://github.com/miguelgrinberg/python-socketio/security/advisories/GHSA-g8c6-8fjj-2r4m","https://nvd.nist.gov/vuln/detail/CVE-2025-61765","https://github.com/miguelgrinberg/python-socketio/commit/53f6be094257ed81476b0e212c8cddd6d06ca39a","https://github.com/miguelgrinberg/python-socketio","https://www.bluerock.io/post/cve-2025-61765-bluerock-discovers-critical-rce-in-socket-io-ecosystem"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-g8c6-8fjj-2r4m","url":"https://osv.dev/vulnerability/GHSA-g8c6-8fjj-2r4m"}],"summary":"python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments"}