{"action":"Upgrade python-socketio to 5.14.0 or later.","affected":[{"fixed":"5.14.0","introduced":"0.8.0"}],"component":"python-socketio","cve_ids":["CVE-2025-61765"],"ecosystem":"PyPI","epss":0.00482,"exploited":false,"fixed_versions":["5.14.0"],"ghsa_id":"GHSA-g8c6-8fjj-2r4m","id":"tcs_01M5KGW2TWEMX9XEC9GMHKG86H","modified_at":"2026-07-07T17:48:07.999163508Z","published_at":"2026-07-07T16:03:06.734448Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1854","https://github.com/miguelgrinberg/python-socketio/security/advisories/GHSA-g8c6-8fjj-2r4m","https://nvd.nist.gov/vuln/detail/CVE-2025-61765","https://github.com/miguelgrinberg/python-socketio/commit/53f6be094257ed81476b0e212c8cddd6d06ca39a","https://github.com/miguelgrinberg/python-socketio","https://www.bluerock.io/post/cve-2025-61765-bluerock-discovers-critical-rce-in-socket-io-ecosystem","https://pypi.org/project/python-socketio","https://github.com/advisories/GHSA-g8c6-8fjj-2r4m"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"PYSEC-2026-1854","url":"https://osv.dev/vulnerability/PYSEC-2026-1854"}],"summary":"python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deployments"}