CVE-2025-27607

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-27607
Python JSON Logger is a JSON Formatter for Python Logging. Between 30 December 2024 and 4 March 2025 Python JSON Logger was vulnerable to RCE through a missing dependency. This occurred because msgspec-python313-pre was deleted by the owner leaving the name open to being claimed by a third party. If the package was claimed, it would allow them RCE on any Python JSON Logger user who installed the development dependencies on Python 3.13 (e.g. pip install python-json-logger[dev]). This issue has been resolved with 3.3.0.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/nhairs/python-json-logger/commit/2548e3a2e3cedf6bef3ee7c60c55b7c02d1af11a Patch
https://github.com/nhairs/python-json-logger/commit/e7761e56edb980cfab0165e32469d5fd017a5d72 Patch
https://github.com/nhairs/python-json-logger/security/advisories/GHSA-wmxh-pxcx-9w24 Exploit Vendor Advisory
https://github.com/nhairs/python-json-logger/security/advisories/GHSA-wmxh-pxcx-9w24 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:nhairs:python_json_logger:*:*:*:*:*:*:*:*
History

01 Jul 2025, 16:22

Type Values Removed Values Added
CPE cpe:2.3:a:nhairs:python_json_logger:*:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo
First Time Nhairs
Nhairs python Json Logger
Summary
  • (es) Python JSON Logger es un formateador JSON para el registro de Python. Entre el 30 de diciembre de 2024 y el 4 de marzo de 2025, Python JSON Logger fue vulnerable a RCE debido a una dependencia faltante. Esto ocurrió porque el propietario eliminó msgspec-python313-pre, lo que dejó el nombre abierto a que un tercero lo reclamara. Si se reclamaba el paquete, les permitiría realizar RCE en cualquier usuario de Python JSON Logger que instalara las dependencias de desarrollo en Python 3.13 (por ejemplo, pip install python-json-logger[dev]). Este problema se ha resuelto con la versión 3.3.0.
References () https://github.com/nhairs/python-json-logger/commit/2548e3a2e3cedf6bef3ee7c60c55b7c02d1af11a - () https://github.com/nhairs/python-json-logger/commit/2548e3a2e3cedf6bef3ee7c60c55b7c02d1af11a - Patch
References () https://github.com/nhairs/python-json-logger/commit/e7761e56edb980cfab0165e32469d5fd017a5d72 - () https://github.com/nhairs/python-json-logger/commit/e7761e56edb980cfab0165e32469d5fd017a5d72 - Patch
References () https://github.com/nhairs/python-json-logger/security/advisories/GHSA-wmxh-pxcx-9w24 - () https://github.com/nhairs/python-json-logger/security/advisories/GHSA-wmxh-pxcx-9w24 - Exploit, Vendor Advisory

07 Mar 2025, 18:15

Type Values Removed Values Added
References () https://github.com/nhairs/python-json-logger/security/advisories/GHSA-wmxh-pxcx-9w24 - () https://github.com/nhairs/python-json-logger/security/advisories/GHSA-wmxh-pxcx-9w24 -

07 Mar 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-07 17:15

Updated : 2025-07-01 16:22

NVD link : CVE-2025-27607

Mitre link : CVE-2025-27607

CVE.ORG link : CVE-2025-27607

JSON object : View

Products Affected

nhairs

  • python_json_logger
CWE
CWE-829

Inclusion of Functionality from Untrusted Control Sphere

NVD-CWE-noinfo