Critical Vulnerability in Python PLY Library Allows Remote Code Execution

A critical vulnerability in the Python PLY library version 3.11 has been identified, enabling remote code execution via unsafe deserialization of untrusted pickle files. The flaw, tracked as CVE-2025-56005, affects the undocumented picklefile parameter in the yacc() function, which invokes pickle.load() on untrusted data. The vulnerability was reported by security researcher Ahmed Abd on July 1, 2025.