Advisory status
CVE-2025-56005 describes unsafe deserialization through PLY's parser-table pickle support. The current NVD/CVE record carries a dispute note: a third party argues that the published proof does not demonstrate arbitrary code execution. Red Hat treats the issue as context-dependent and rates it Important rather than accepting the original universal critical rating. [S1] [S2]
When the risk is real
PLY 3.11 source accepts a parser-table pickle path and, when an existing file is present, reads it with Python's pickle loader. Python pickle is not safe across trust boundaries because loading crafted data can execute code. The dangerous condition therefore requires both explicit use of the parser-table pickle feature and a way for a less-trusted user, upload path, build job, shared volume, sibling service, or compromised artifact source to create or replace the file. [S2] [S3]
Repository evidence alone cannot prove that the parser runs in production, that the file exists, or that an attacker can influence it. Those deployment and filesystem questions determine whether the configuration is exploitable.
Concrete fixes
- Remove the parser-table pickle option from PLY parser construction.
- Generate parser tables from trusted grammar source through PLY's normal build/import path.
- Delete old parser-table pickle files from source control, build outputs, caches, container layers, artifact stores, and deployed volumes before rebuilding.
- Review build and runtime directory ownership so uploads, tenants, users, CI jobs, and sibling services cannot replace parser artifacts.
- Run normal parser regression tests and rebuild from a clean workspace. Do not open a suspicious pickle to test whether it is malicious.
The reviewed sources do not identify a patched PLY release, and PyPI still lists 3.11 as the current release. Removing the unsafe configuration is the direct remediation rather than waiting for a version-only fix. [S2] [S4]
How FixVibe covers it
Covered by FixVibe. Authorized GitHub repository scans review Python parser configuration for explicit use of PLY's unsafe parser-table deserialization path. Findings are reported as high-severity likely issues with the source location and a clear list of what remains unverified.
FixVibe does not open parser-table files, execute Python payloads, run the parser, or claim remote code execution from repository evidence. It also does not flag a PLY dependency by itself; the repository must contain the unsafe source configuration.