GHSA-QW48-84F6-28GV

Workarounds

If users cannot upgrade immediately:

1. Do not load database files from untrusted or unknown sources when using versions <0.2.
2. Migrate existing pickle-based databases to the new JSON format using the provided migration module:

from graphite.Migration import convert_pickle_to_json
convert_pickle_to_json("path/to/old_database.pkl", "path/to/new_database.json")

After migration, you can safely use the database with version 0.2+.

Note: Versions 0.2 and later will show a warning when attempting to load legacy pickle files, reminding you to migrate them. Also, you can't load pickle files in 0.2 and later.

Resources

• Upgrade to v0.2 or newer
• Migration guide: See graphite.Migration module documentation
• More on pickle security: Python docs, pickle security

Type of vulnerability: Insecure Deserialization via Python's pickle module.

Who is impacted:
Users of Graphite graph database engine versions before 0.2 who load database files from untrusted or third-party sources.
An attacker could craft a malicious database file that executes arbitrary code when loaded by the engine. This is possible because the engine used pickle for serialization, which is known to be unsafe for untrusted data.

Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect. Typical impact: arbitrary code execution or logic abuse.

GHSA-QW48-84F6-28GV has a CVSS score of 7.8 (High). The vector is requires local access, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.2); upgrading removes the vulnerable code path.

Kodem intelligence

The vulnerability has been patched starting from version 0.2.
All users should upgrade to version 0.2 or later (the current version is 0.4 at publishing time).
In version 0.2 and above, the engine uses JSON instead of pickle for database storage, eliminating the deserialization risk.

1. What is GHSA-QW48-84F6-28GV? GHSA-QW48-84F6-28GV is a high-severity insecure deserialization vulnerability in graphitedb (pip), affecting versions < 0.2. It is fixed in 0.2. Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect.
2. How severe is GHSA-QW48-84F6-28GV? GHSA-QW48-84F6-28GV has a CVSS score of 7.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of graphitedb are affected by GHSA-QW48-84F6-28GV? graphitedb (pip) versions < 0.2 is affected.
4. Is there a fix for GHSA-QW48-84F6-28GV? Yes. GHSA-QW48-84F6-28GV is fixed in 0.2. Upgrade to this version or later.
5. Is GHSA-QW48-84F6-28GV exploitable, and should I be worried? Whether GHSA-QW48-84F6-28GV is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-QW48-84F6-28GV is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-QW48-84F6-28GV? Upgrade graphitedb to 0.2 or later.