CVE-2025-62703

The Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine.

Details

_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization.

PoC

• Step1:
  The victim user starts an RPC server binding to open network using the Fugue framework. Here, I use the official RPC server code to initialize the server.

• Step2:
  The attacker modifies the _encode() function in fugue/rpc/flask.py to inject malicious pickle data:

In this example, attacker modifies _encode to let the victim execute command “ls -l”

• Step 3:
  The attacker then uses the RPC client to send the malicious request

Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py.

Mitigation

1. Replace unsafe deserialization: Replace pickle.loads() with safer alternatives such as:

   • JSON serialization for simple data structures
   • Protocol Buffers or MessagePack for complex data
   • If pickle must be used, implement a custom Unpickler with a restricted find_class() method that only allows whitelisted classes

2. Network security:

   • If the service is intended for internal use only, bind to localhost (127.0.0.1) instead of 0.0.0.0
   • Implement authentication and authorization mechanisms

3. Security warnings: When starting the service on public interfaces, display clear security warnings to inform users about the risks.

Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing

Remote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:

• Complete system compromise
• Data exfiltration
• Lateral movement within the network
• Denial of service attacks
• Installation of persistent backdoors

Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.

CVE-2025-62703 has a CVSS score of 8.8 (High). The vector is reachable from an adjacent network, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. No fixed version is listed yet, so configuration controls and monitoring matter more in the interim.

Kodem intelligence

1. What is CVE-2025-62703? CVE-2025-62703 is a high-severity OS command injection vulnerability in fugue (pip), affecting versions <= 0.9.2. No fixed version is listed yet. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
2. How severe is CVE-2025-62703? CVE-2025-62703 has a CVSS score of 8.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of fugue are affected by CVE-2025-62703? fugue (pip) versions <= 0.9.2 is affected.
4. Is there a fix for CVE-2025-62703? No fixed version is listed for CVE-2025-62703 yet. Monitor the advisory for updates and apply mitigations in the interim.
5. Is CVE-2025-62703 exploitable, and should I be worried? Whether CVE-2025-62703 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2025-62703 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2025-62703? No fixed version is listed yet. In the interim: Avoid passing untrusted input to shell commands. Use parameterized APIs or libraries that do not invoke a shell.