{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"ply","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NP2H675JTWSNA91DSTM9C2","modified_at":"2026-09-18T08:47:25.525439247Z","published_at":"2026-01-20T19:15:49.247Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2025-56005","https://security-tracker.debian.org/tracker/CVE-2025-56005"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2025-56005","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2025-56005"}],"summary":"An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl`"}