CNNVD-202510-2459 Information
Oct 17, 2025
cve
CNNVD ID
CNNVD-202510-2459
Related CVE
- CNNVD Published: 2025-10-17
Description (Chinese)
Quokka是开源的一个用 Python 编写的内容管理框架。 quokka 0.3.1及之前版本存在代码问题漏洞，该漏洞源于FlightServer类在do_action方法中直接使用pickle.loads反序列化来自Flight客户端的操作数据，可能导致远程代码执行。
Description (English)
Quokka is a content management framework developed by Python, an open source. quokka 0.3.1 and previous versions had a code problem loophole, which stemmed from the direct use by the FlightServer category of pickle.loads back-sequencing operational data from the Flash client in the do action method, which could lead to remote code execution.
Hazard Level
High
Vulnerability Type
代码问题
Affected Vendor
个人开发者
Published
2025-10-17
Last Modified
2026-02-24
References
https://github.com/marsupialtail/quokka/security/advisories/GHSA-f74j-gffq-vm9p https://access.redhat.com/security/cve/cve-2025-62515
Patch
https://github.com/marsupialtail/quokka/releases
Share on: