Arbitrary Code Execution in Pyquokka Framework by MarsupialTail

CVE-2025-62515

What is CVE-2025-62515?

The Pyquokka Framework, designed for managing data lakes in time series, contains a security flaw in its FlightServer class. Specifically, the do_action() method uses pickle.loads() without proper validation or sanitation, allowing attackers to execute arbitrary code remotely. When the FlightServer listens on 0.0.0.0, this vulnerability exposes the service to potential exploitation across the network via malformed pickled payloads sent through the set_configs action. Additional risks are present in the cache_garbage_collect, do_put, and do_get functions, all of which also utilize unsafe deserialization of untrusted data.

References