An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code via `__reduce__()`, an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.
[POC] CVE-2025-56005 — Undocumument_RCE_PLY-yacc-CVE-2025-56005
Clarification Regarding the Rejection Arguments
[POC] CVE-2025-56005 — ply_exploit_rejection
Arguments to reject CVE-2025-56005
PoC: ply-cve-2025-56005-lab
Lab demonstrating that CVE-2025-56005 is real and does allow arbitrary code execution at a minimum (the debate about RCE notwithstanding here), and shows that ply-safepickle does block the exploit path.
PoC: ply-safepickle
This is a modified version of PLY 3.11, from PyPI (current defunct git repo is not current to PyPI) which reimplements the pickle function in yacc.py to resolve CVE-2025-56005.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free