Code Execution Vulnerability in Cryptidy by Netinvent
CVE-2025-63675

6.9MEDIUM

Key Information:

Vendor

Cryptidy

Status
Cryptidy
Vendor
CVE Published:
31 October 2025

What is CVE-2025-63675?

Cryptidy version 1.2.4 utilizes the pickle.loads function, which can lead to severe security risks by allowing the execution of arbitrary code when processing untrusted data. This critical flaw resides in the aes_decrypt_message function found in symmetric_encryption.py. Proper input validation and alternative serialization formats should be considered to mitigate these risks.

Affected Version(s)

cryptidy 0 <= 1.2.4

References

https://github.com/javiermorales36/cryptidy-analysis
https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20...

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-63675 : Code Execution Vulnerability in Cryptidy by Netinvent