Description
cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cryptidy | cryptidy | ≤ 1.2.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cryptidy | <= 1.2.4 | — | GHSA-97w9-v595-3h5q |