EPyT-Flow Remote Code Execution Vulnerability via Unsafe JSON Deserialization

A remote code execution vulnerability exists in EPyT-Flow versions prior to 0.16.1. The issue arises in the REST API, where attacker-controlled JSON request bodies are parsed using a custom deserializer that supports a type field. When the type field is present, the deserializer dynamically imports an attacker-specified module or class and instantiates it with provided arguments. This functionality can be exploited to invoke dangerous classes, such as subprocess.Popen, leading to OS command execution during JSON parsing. The vulnerability also affects the loading of JSON files.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where EPyT-Flow is running.

Remediation

EPyT-Flow has been patched in version 0.16.1. Users should update to this version. Additionally, it is recommended not to load JSON from untrusted sources and to avoid exposing the REST API.