---
title: "CVE-2025-58367\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2025-58367?format=md
keywords: index, follow
---

# CVE-2025-58367

Publication date 5 September 2025

Last updated 10 July 2026

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

Toggle side navigation

## Description

DeepDiff is a project focused on Deep Difference and search of any Python
data. Versions 5.0.0 through 8.6.0 are vulnerable to class pollution via
the Delta class constructor, and when combined with a gadget available in
DeltaDiff, it can lead to Denial of Service and Remote Code Execution (via
insecure Pickle deserialization) exploitation. The gadget available in
DeepDiff allows `deepdiff.serialization.SAFE\_TO\_IMPORT` to be modified to
allow dangerous classes such as posix.system, and then perform insecure
Pickle deserialization via the Delta class. This potentially allows any
Python code to be executed, given that the input to Delta is
user-controlled. Depending on the application where DeepDiff is used, this
can also lead to other vulnerabilities. This is fixed in version 8.6.1.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| deepdiff | 26.04 LTS resolute | Not affected |
| 25.10 questing | Ignored end of life, was needs-triage |
| 24.04 LTS noble | Needs evaluation |
| 22.04 LTS jammy | Needs evaluation |
| 20.04 LTS focal | Needs evaluation |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:
CVSS v4.0

**Base score**

10.0 · Critical

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Attack requirements | None |
  | Privileges required | None |
  | User interaction | None |
  | Vulnerable system - Confidentiality impact | High |
  | Vulnerable system - Integrity impact | High |
  | Vulnerable system - Availability impact | High |
  | Subsequent system - Confidentiality impact | High |
  | Subsequent system - Integrity impact | High |
  | Subsequent system - Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 10.0 · Critical |
  | Base + Threat score | - |
  | Base + Environmental score | - |
  | Base + Threat + Environmental score | - |

**Vector:** CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58367)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-58367)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2025-58367)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2025-58367)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2025-58367>
* <https://github.com/qlustered/deepdiff/security/advisories/GHSA-mw26-5g2v-hqw3>