{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.2.4"}],"component":"cryptidy","cve_ids":["CVE-2025-63675"],"ecosystem":"PyPI","epss":0.00252,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-97w9-v595-3h5q","id":"tcs_01M5KGRNCHG8NHKA8J4VKN77HH","modified_at":"2026-07-07T17:47:34.754256029Z","published_at":"2026-07-07T16:03:09.298310Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1282","https://nvd.nist.gov/vuln/detail/CVE-2025-63675","https://github.com/javiermorales36/cryptidy-analysis","https://github.com/netinvent/cryptidy","https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.py#L220-L238","https://pypi.org/project/cryptidy","https://github.com/advisories/GHSA-97w9-v595-3h5q"],"severity":{"label":"medium","score":6.9},"sources":[{"source":"osv","source_id":"PYSEC-2026-1282","url":"https://osv.dev/vulnerability/PYSEC-2026-1282"}],"summary":"cryptidy allows code execution via untrusted data due to pickle.loads"}