Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more

Fix availableCritical · CVSS 10EPSS 1.2%

Published Sep 3, 2025 · updated Oct 27, 2026

What to do

  1. Upgrade to a fixed version: deepdiff 8.6.1.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIdeepdiff14,265,130 downloads/week

Vulnerable versions
>= 5.0.0, < 8.6.1
Fixed in
8.6.1

Check your project: pip show deepdiff

Sources

CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

← All critical vulnerabilities