CVE-2026-25632: Deserialization of Untrusted Data

EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer myloadfromjson that supports a type field...

Deserialization of Untrusted Data

Overview epyt-flow is an EPyT-Flow -- EPANET Python Toolkit - Flow Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the type parameter in myloadfromjson. An attacker can execute arbitrary code by supplying a malicious JSON body containing a type field that...