GHSA-F5CX-H789-J959

Vulnerability from github – Published: 2025-06-19 16:19 – Updated: 2025-06-20 14:19
VLAI
Summary
PowSyBl Core allows deserialization of untrusted SparseMatrix data
Details

Impact

What kind of vulnerability is it? Who is impacted?

This is a disclosure for a security vulnerability in the SparseMatrix class. The vulnerability is a deserialization issue that can lead to a wide range of privilege escalations depending on the circumstances. The problematic area is the read method of the SparseMatrix class. This method takes in an InputStream and returns a SparseMatrix object. We consider this to be a method that can be exposed to untrusted input in at least two use cases: - A user can adopt this method in an application where users can submit an InputStream and the application parses it into a SparseMatrix. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. - A user adopts the method for a local tool but receives the InputStream from external sources.

Am I impacted?

You are vulnerable if you import non-controlled serialized SparseMatrix objects.

Patches

com.powsybl:powsybl-math:6.7.2 and higher

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Do not use SparseMatrix deserialization (SparseMatrix.read(...) methods).

References

powsybl-core v6.7.2

Severity
8.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.7.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "com.powsybl:powsybl-math"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.3.0"
            },
            {
              "fixed": "6.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-47771"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-19T16:19:16Z",
    "nvd_published_at": "2025-06-20T00:15:29Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThis is a disclosure for a security vulnerability in the `SparseMatrix` class. The vulnerability is a deserialization issue that\ncan lead to a wide range of privilege escalations depending on the circumstances. The problematic area is the `read` method\nof the `SparseMatrix` class.\nThis method takes in an `InputStream` and returns a `SparseMatrix` object. We consider this to be a method that can be\nexposed to untrusted input in at least two use cases:\n- A user can adopt this method in an application where users can submit an `InputStream` and the application parses it into\na `SparseMatrix`. This can be a multi-tenant application that hosts many different users perhaps with different privilege\nlevels.\n- A user adopts the method for a local tool but receives the `InputStream` from external sources.\n\n#### Am I impacted?\nYou are vulnerable if you import non-controlled serialized `SparseMatrix` objects.\n\n\n### Patches\ncom.powsybl:powsybl-math:6.7.2 and higher\n\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nDo not use `SparseMatrix` deserialization (`SparseMatrix.read(...)` methods).\n\n### References\n[powsybl-core v6.7.2](https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2)",
  "id": "GHSA-f5cx-h789-j959",
  "modified": "2025-06-20T14:19:25Z",
  "published": "2025-06-19T16:19:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/powsybl/powsybl-core/security/advisories/GHSA-f5cx-h789-j959"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47771"
    },
    {
      "type": "WEB",
      "url": "https://github.com/powsybl/powsybl-core/commit/8ed16ce41683c4aef5f6aa1dd5ae8642aa5ed2bd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/powsybl/powsybl-core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PowSyBl Core allows deserialization of untrusted SparseMatrix data"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.