CVE-2025-47771: PowSyBl Core allows deserialization of untrusted SparseMatrix data
(updated )
What kind of vulnerability is it? Who is impacted?
This is a disclosure for a security vulnerability in the SparseMatrix class. The vulnerability is a deserialization issue that
can lead to a wide range of privilege escalations depending on the circumstances. The problematic area is the read method
of the SparseMatrix class.
This method takes in an InputStream and returns a SparseMatrix object. We consider this to be a method that can be
exposed to untrusted input in at least two use cases:
- A user can adopt this method in an application where users can submit an
InputStreamand the application parses it into aSparseMatrix. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. - A user adopts the method for a local tool but receives the
InputStreamfrom external sources.
References
- github.com/advisories/GHSA-f5cx-h789-j959
- github.com/powsybl/powsybl-core
- github.com/powsybl/powsybl-core/commit/8ed16ce41683c4aef5f6aa1dd5ae8642aa5ed2bd
- github.com/powsybl/powsybl-core/releases/tag/v6.7.2
- github.com/powsybl/powsybl-core/security/advisories/GHSA-f5cx-h789-j959
- nvd.nist.gov/vuln/detail/CVE-2025-47771
Code Behaviors & Features
Detect and mitigate CVE-2025-47771 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →