Critical Python PLY Library Vulnerability Enables Remote Code Execution

A critical security issue has been disclosed in the Python PLY (Python Lex‑Yacc) library that can allow remote code execution (RCE) through an undocumented feature in the PyPI‑distributed version 3.11.

The flaw is tracked as CVE‑2025‑56005 and was reported by security researcher Ahmed Abd, with disclosure dated July 1, 2025.

CVE‑2025‑56005 – Technical Overview

The vulnerability stems from an undocumented picklefile parameter in ply.yacc.yacc(). When used, this parameter causes PLY to load parser tables from a .pkl file using Python’s pickle.load() without any validation.

Because Python’s pickle The module can execute arbitrary code during deserialization (for example, via __reduce__()), an attacker who can control or influence the .pkl file passed to yacc(picklefile=...) can execute arbitrary code on the system during parser initialization—before any actual parsing logic runs.

Notably, this parameter is not documented in the official PLY documentation or GitHub repository, yet it is active in the PyPI release of PLY 3.11. At the time of disclosure, the maintainer had not publicly acknowledged this behavior.

If an attacker can place or modify the pickle file used by yacc(picklefile=...), they can achieve:

• Arbitrary code execution
• Execution during application startup or parser setup
• Stealthy persistence via poisoned parser tables

Risk is higher in environments where parser table files are:

• Cached on disk
• Stored in shared directories between users or services
• Generated or reused in CI/CD pipelines
• Loaded from configurable or writable paths

In such setups, an attacker who compromises the build infrastructure, a shared file system, or a deployment pipe could introduce a malicious .pkl file that silently executes code whenever the parser is initialized.

The published proof of concept defines a minimal lexer and parser, then crafts a malicious pickle payload.

A custom Exploit class uses __reduce__() to run an operating system command (for example, creating a /tmp/pwned file) during deserialization.

When yacc(picklefile='exploit.pkl', ...) is invoked, the command is executed as soon as the parser tables are loaded, even before any input is parsed.

Until a fixed release is available, users of PLY should:

• Avoid using the picklefile parameter, especially with files from untrusted or writable locations
• Treat all pickle files as untrusted input, even if they appear to be internal cache files
• Prefer regenerating parser tables at startup rather than loading them from disk
• Harden file paths and permissions for any parser table storage locations

Organizations should review codebases for the usage of yacc(picklefile=...), audit CI/CD and shared storage paths where .pkl parser tables may reside, and monitor for vendor updates related to CVE‑2025‑56005.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.