CVE-2025-4905 is a medium severity deserialization flaw (CVSS 5.3) in iop-apl-uw basestation3 up to version 3.0.4. The function load_qc_pickl in basestation3/QC.py handles the qc_file argument unsafely. The attack is local. No fixed release was confirmed when the record was written.
What's affected
The record lists basestation3 versions up to and including 3.0.4. The affected function is load_qc_pickl in basestation3/QC.py, and the argument is qc_file.
The record also contains a status note. The maintainer tagged the public issue as closed, but at the time of the record there was no new commit or release in the repository. Closed in the issue tracker therefore does not tell you that a fixed version exists. Check the repository history and release page yourself before you rely on a newer version.
How to check if you're exposed
First find out whether you use the package. In a Python environment:
pip show basestation3
pip list 2>/dev/null | grep -i basestation
If you installed it from a Git checkout, look at the repository tag or commit. Then look at where qc_file values come from in your workflow. The CVSS vector in the record lists a local attack vector with low privileges required, so the question is who can place or change the file that gets loaded. A file that only your own processing pipeline writes is a very different risk from a file that arrives from a collaborator or an upload.
Reading the code is quick. Search for the function and see how the file is opened:
grep -rn "load_qc_pickl" .
What to do now
- Find every copy of basestation3 in your environments, including analysis notebooks and shared compute hosts.
- Check the project repository for a commit or release that changes load_qc_pickl, and update if one exists.
- Do not load QC files that came from outside your control. Keep the directory they live in writable only by trusted accounts.
- If you can, change the storage format of those files to a data only format such as JSON, or verify file integrity with a checksum from a trusted source before loading.
- Run the processing under an account with limited rights.
Why it matters
The record files this under CWE-502, deserialization of untrusted data, together with CWE-20, improper input validation. The function name suggests that the file is a Python pickle. The pickle format is designed to rebuild live objects, and loading a pickle from an untrusted source can run code chosen by whoever wrote it. That is a property of the format, not a mistake in one program.
The score is moderate because the attack needs local access. Scientific and data processing tools often pass files around between people, which is where this kind of issue turns real. The record says an exploit has been disclosed publicly. This CVE is not on the CISA Known Exploited Vulnerabilities list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
The issue is closed. Is it fixed?
Not necessarily. The record notes that no new commit or release was available when it was written. Check the repository before you assume a fix.
Is a local attack worth worrying about?
It depends on who can write the files the code loads. If outsiders can place files on the host or in a shared folder, treat it seriously.
Sources
Last reviewed: 18 October 2026.
