CVE-2025-30358

Advisory

Affected versions of the Mesop Python package (≤ 0.14.0) are vulnerable to a class pollution vulnerability. An attacker may exploit improper handling of double-underscore properties in dataclass utilities to overwrite critical global and class attributes, potentially triggering denial-of-service (DoS) and identity impersonation attacks. The vulnerability is exploitable via remote JSON input and affects functions such as update_dataclass_from_json. Remediation involves upgrading to Mesop version 0.14.1 or later. Note: This issue is specific to Python frameworks and is rated CVSS 8.1 (CWE-915), reflecting independent assessments beyond standard Mitre/NVD metrics.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-f3mf-hm6v-jfhh
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30358