CVE-2025-6279

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6. This issue affects the function cloudpickle.loads of the file /tools/add_tool of the component Pickle Handler. The manipulation leads to deserialization. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-502

Affected software

Vendor	Product	Versions
n/a	Upsonic	0.55.0; 0.55.1; 0.55.2; 0.55.3; 0.55.4; 0.55.5; 0.55.6

References

https://github.com/Upsonic/Upsonic/issues/353Exploit, Issue Tracking
https://vuldb.com/?ctiid.313283Permissions Required, VDB Entry
https://vuldb.com/?id.313283Third Party Advisory, VDB Entry
https://vuldb.com/?submit.593099Third Party Advisory, VDB Entry
https://github.com/Upsonic/Upsonic/issues/353Exploit, Issue Tracking

Timeline

Published: Jun 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-627907.5Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, fim_fetch_attributes_state() CVE-2025-627917.5Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, DecodeCiscat() implementation CVE-2025-627927.5Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.12.0, a buffer over-read occurs in CVE-2025-627936.8eLabFTW is an open source electronic lab notebook for research labs. The application served uploaded SVG files inline. Because SVG supports CVE-2025-627943.8GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security. Before 0.0.CVE-2025-627957.1JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a CVE-2025-627965.8PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Versions 1.7.7 through 2.0.1 allow persistent HTML inje CVE-2025-627978.6FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in CVE-2025-627985.4Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was disc CVE-2025-627999.8Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.CVE-2025-62809.8A vulnerability, which was classified as critical, was found in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function download_CVE-2025-628006.1FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerabilit