fugue
An abstraction layer for distributed computing
View on Github
Activity
- Latest release
- 6mo ago
- Total releases
- 126
- Cadence
- ~9 days
- Last 12 months
- 9
Reach
- Stars
- —
Details
- License
- Apache-2.0
- First release
- Mar 24, 2020
| Version | Released | |
|---|---|---|
0.9.7
patch
| ||
0.9.7.dev2
pre
| ||
0.9.7.dev1
pre
| ||
0.9.7.dev0
pre
| ||
0.9.6
patch
| ||
0.9.5
patch
| ||
0.9.4
patch
| ||
0.9.3
patch
| ||
0.9.2
patch
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.9.2.dev2
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.9.2.dev1
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.9.1
patch
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.9.0
minor
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.9.0.dev4
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.9.0.dev3
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.9.0.dev2
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.7
patch
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.7.dev8
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.7.dev7
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.7.dev6
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.7.dev5
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.7.dev4
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.7.dev3
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.7.dev2
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.7.dev1
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.6
patch
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.6.dev3
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.6.dev2
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.6.dev1
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.5
patch
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.5.dev1
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.4
patch
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.4.dev2
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.4.dev1
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.3
patch
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.3.dev1
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.2
patch
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.2.dev4
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.2.dev3
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.2.dev2
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.2.dev1
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.1
patch
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.1.dev4
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.1.dev3
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.1.dev1
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.0
minor
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.0.dev4
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.0.dev3
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.0.dev2
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
0.8.0.dev1
pre
1 CVE
CVE-2025-62703
PYSEC-2026-1399
GHSA-xv5p-fjw5-vrj6
Jul 07, 2026
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer
8.8
/ 10
High
Adjacent
Low
None
None
Unchanged
High
High
High
SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the _decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. This creates a remote code execution vulnerability when malicious pickle data is processed by the RPC server.The vulnerability exists in the RPC communication mechanism where the client can send arbitrary serialized Python objects that will be deserialized on the server side, allowing attackers to execute arbitrary code on the victim's machine. Details_decode() function in fugue/rpc/flask.py directly uses cloudpickle.loads() to deserialize data without any sanitization. PoC
In this example, attacker modifies _encode to let the victim execute command “ls -l”
Fugue gives a demo video and the PoC in the attachment, along with modified flask.py. When users reproduce this issue, in the server side (as an victim), users can run python rpc_server.py. In the client side (as an attacker), users can first replace fugue/rpc/flask.py in pip site-packages with provided flask.py in the attachment and then run rpc_client.py. ImpactRemote code execution in the victim's machine. Once the victim starts the RPCServer with network binding (especially 0.0.0.0), an attacker on the network can gain arbitrary code execution by connecting to the RPCServer and sending crafted pickle payloads. This vulnerability allows for:
Mitigation
Attachment: https://drive.google.com/file/d/1y8bBBp7dnWoT_WHBtdB0Fts4NRUIfdWi/view?usp=sharing Affected versions
0.0.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.0.dev0
+ 106 more Show less
0.5.0.dev1
0.5.0.dev2
0.5.1
0.5.1.dev0
0.5.1.dev1
0.5.1.dev2
0.5.1.dev3
0.5.1.dev4
0.5.1.dev5
0.5.1.dev6
0.5.2
0.5.2.dev0
0.5.2.dev1
0.5.2.dev2
0.5.3
0.5.3.dev1
0.5.4
0.5.5
0.5.5.dev1
0.5.6
0.5.6.dev1
0.5.6.dev2
0.5.7.dev1
0.6.0
0.6.0.dev1
0.6.0.dev2
0.6.0.dev3
0.6.1
0.6.1.dev1
0.6.1.dev2
0.6.1.dev3
0.6.2
0.6.3
0.6.4
0.6.4.dev1
0.6.4.dev2
0.6.5
0.6.5.dev1
0.6.5.dev2
0.6.5.dev3
0.6.5.dev4
0.6.5.dev5
0.6.5.dev6
0.6.5.dev7
0.6.5.dev8
0.6.5.dev9
0.6.6
0.6.6.dev1
0.6.6.dev2
0.6.6.dev3
0.7.0
0.7.0.dev1
0.7.0.dev2
0.7.0.dev3
0.7.0.dev4
0.7.0.dev5
0.7.1
0.7.1.dev1
0.7.2
0.7.3
0.7.3.dev0
0.7.3.dev1
0.7.4.dev0
0.7.4.dev1
0.8.0
0.8.0.dev1
0.8.0.dev2
0.8.0.dev3
0.8.0.dev4
0.8.1
0.8.1.dev1
0.8.1.dev3
0.8.1.dev4
0.8.2
0.8.2.dev1
0.8.2.dev2
0.8.2.dev3
0.8.2.dev4
0.8.3
0.8.3.dev1
0.8.4
0.8.4.dev1
0.8.4.dev2
0.8.5
0.8.5.dev1
0.8.6
0.8.6.dev1
0.8.6.dev2
0.8.6.dev3
0.8.7
0.8.7.dev1
0.8.7.dev2
0.8.7.dev3
0.8.7.dev4
0.8.7.dev5
0.8.7.dev6
0.8.7.dev7
0.8.7.dev8
0.9.0
0.9.0.dev2
0.9.0.dev3
0.9.0.dev4
0.9.1
0.9.2
0.9.2.dev1
0.9.2.dev2
References
Updated Jul 07, 2026 · Source: OSV.dev |