漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
EPyT-Flow has unsafe JSON deserialization (__type__)
Vulnerability Description
EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files. This vulnerability is fixed in 0.16.1.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability Type
可信数据的反序列化
Vulnerability Title
EPyT-Flow 代码问题漏洞
Vulnerability Description
EPyT-Flow是ERC Synergy Grant Water Futures开源的一个用于生成配水网络的水力和水质场景数据的Python包。 EPyT-Flow 0.16.1之前版本存在代码问题漏洞，该漏洞源于REST API使用支持类型字段的自定义反序列化器解析攻击者控制的JSON请求体，可能导致OS命令执行。
CVSS Information
N/A
Vulnerability Type
N/A