EPyT-Flow versions up to 0.16.0 contain a critical vulnerability in their REST API where unsafe JSON deserialization allows attackers to specify a __type__ field. This enables dynamic import and instantiation of arbitrary classes, including dangerous ones like subprocess.Popen, leading to remote OS command execution. The vulnerability is fixed in version 0.16.1. Users should avoid loading JSON from untrusted sources and not expose the REST API until patched.