Vulnerability GHSA-cq46-m9x9-j8w2
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
1 year ago
October 22, 2025 at 04:45 PM UTC
Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization
2.2.0-dev and 2.3.1 - 2.3.3 and 2.4rc2 and 2.4.0rc3 and 2.4.0rc4 and 2.4.0rc5 and 2.4.0 - 2.4.3rc1 and 2.4.3rc2 and 2.4.3rc3 and 2.4.3rc4 and 2.4.3 - 2.4.4rc1 and 2.4.4rc2 and 2.4.4 - 2.4.5rc1 and 2.4.5 - 2.5.0rc1 and 2.5.0rc2 and 2.5.0rc3 and 2.5.0 - 2.6.0rc1 and 2.6.0rc2 and 2.6.0 - 2.6.1
2.2.0-dev and 2.3.1 - 2.3.3 and 2.4rc2 and 2.4.0rc3 and 2.4.0rc4 and 2.4.0rc5 and 2.4.0 - 2.4.3rc1 and 2.4.3rc2 and 2.4.3rc3 and 2.4.3rc4 and 2.4.3 - 2.4.4rc1 and 2.4.4rc2 and 2.4.4 - 2.4.5rc1 and 2.4.5 - 2.5.0rc1 and 2.5.0rc2 and 2.5.0rc3 and 2.5.0 - 2.6.0rc1 and 2.6.0rc2 and 2.6.0 - 2.6.1
Summary
Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization
Details
Summary
An unsafe deserialization vulnerability in Scapy <v2.7.0 allows attackers to execute arbitrary code when a malicious session file is locally loaded via the -s option. This requires convincing a user to manually load a malicious session file.
Mitigations
- Do not use 'sessions' (the -s option when launching Scapy).
- Use the Scapy 2.7.0+ where the session mechanism has been removed.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
7 years ago
Infinite Loop in scapy
2.4rc2 and 2.4.0rc3 and 2.4.0rc4 and 2.4.0rc5 and 2.4.0 GHSA-mpf2-q34c-fc6j
2.4rc2 and 2.4.0rc3 and 2.4.0rc4 and 2.4.0rc5 and 2.4.0 GHSA-mpf2-q34c-fc6j
Unknown
7 years ago
No summary available
2.2.0-dev and 2.3.1 - 2.3.3 and 2.4rc2 and 2.4.0rc3 and 2.4.0rc4 and 2.4.0rc5 and 2.4.0 PYSEC-2019-120
2.2.0-dev and 2.3.1 - 2.3.3 and 2.4rc2 and 2.4.0rc3 and 2.4.0rc4 and 2.4.0rc5 and 2.4.0 PYSEC-2019-120
Impacted packages
Timeline
Published
1 year ago
October 22, 2025 at 04:45 PM UTC
Last Modified
15 hours ago
November 14, 2026 at 02:56 AM UTC