Critical security vulnerability in ply dependency (CVE-2025-56005)

[hubbs5]

Summary

Pyomo's dependency on ply introduces a critical (CVSS 9.3) deserialization vulnerability (CVE-2025-56005) disclosed on 2026-01-20. Since ply has no patched version available, this is blocking organizations using CI/CD pipelines with security scanning enabled (Snyk, Dependabot, etc.).

This isn't a runtime bug in the traditional sense—it's a transitive dependency vulnerability that requires evaluation and action from the Pyomo team.

Steps to reproduce the issue

$ pip install pyomo
$ snyk test

Or any security scanner that checks for CVE-2025-56005 / SNYK-PYTHON-PLY-15046763.

Error Message

Snyk (and similar tools) report:

Issues with no direct upgrade or patch:
  ✗ Deserialization of Untrusted Data [Critical Severity][https://security.snyk.io/vuln/SNYK-PYTHON-PLY-15046763] in ply@3.11
    introduced by ply@3.11 and 1 other path(s)
  No upgrade or patch available

The vulnerability is in the picklefile parameter of ply.yacc(), which deserializes pickle files without validation, enabling arbitrary code execution via crafted pickle files.

Information on your system

Pyomo version: 6.9.2
Python version: 3.12
Operating system: Linux (CI/CD)
How Pyomo was installed: PyPI
Solver: N/A (vulnerability is in parser infrastructure)

Additional information

Vulnerability references:

• Snyk Advisory
• CWE-502

Questions for the team:

1. Does Pyomo's usage of ply.yacc() invoke the vulnerable picklefile parameter?
2. If so, is there a configuration that avoids the vulnerable code path?
3. Is migration to an alternative parser (e.g., lark, sly) on the roadmap?

Potential paths forward:

• Document whether Pyomo's ply usage is actually exploitable in practice
• Vendor a patched fork of ply if the fix is straightforward
• Migrate to an actively maintained parser generator

This is blocking production deployments for organizations with security policy enforcement. Any guidance on timeline or workarounds would be appreciated.

[blnicho]

@hubbs5 thanks for the detailed issue report. We'll discuss this at our next developer meeting and figure out how to address this. Our next release is currently planned for mid-February.

[hubbs5]

Thanks!

From what I can tell, the use of ply in Pyomo doesn't expose itself to the unsafe deserialization bug, but we're currently blocked by security on deploying any optimization model that depends on Pyomo until this gets resolved. I'm certain my organization isn't the only one to be affected by this.

[michaelbynum]

Current plan:

• make ply an optional dependency
• make sure ply is available for parsing dat files
• replace ply in other places