Moderate severityNVD Advisory· Published Oct 31, 2025· Updated Oct 31, 2025

CVE-2025-63675

Description

cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
cryptidyPyPI	<= 1.2.4	—

Affected products

ghsa-coords
pkg:pypi/cryptidy
Range: <= 1.2.4
Cryptidy/Cryptidyv5
Range: 0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-97w9-v595-3h5qghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-63675ghsaADVISORY
github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.pyghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000