Remote Code Execution Vulnerability in Python-SocketIO by Miguel Grinberg

CVE-2025-61765

What is CVE-2025-61765?

The python-socketio library, a Python implementation for real-time communication, contains a remote code execution vulnerability in its versions prior to 5.14.0. This issue arises from unsafe deserialization of messages encoded with Python's pickle module, particularly in configurations where a message queue backend (such as Redis) is used for inter-server communication. An attacker who gains access to the message queue can inject a malicious pickle payload that will be executed when deserialized by the server, potentially compromising the security context and privileges of the socket server process. To mitigate this risk, it is critical to secure the message queue and upgrade to version 5.14.0 or newer, which replaces the pickle module with a more secure JSON encoding for inter-server messages.

References