GitHub Advisoryadvisory · PyPI

GHSA-5qwj-342r-h886 pypickle unsafe deserialization vulnerability

MEDIUM Published 2025-05-26 Modified 2025-06-04 Official page ↗
Aliases
CVE-2025-5174
Ecosystem
PyPI
Packages
pypickle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-20, CWE-502
Reviewed
2025-05-27

Affected packages

• PyPI pypickle: < 2.0.0 → fixed in 2.0.0

Description

A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. Affected by this issue is the function load of the file pypickle/pypickle.py. The manipulation leads to deserialization. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 14b4cae704a0bb4eb6723e238f25382d847a1917. It is recommended to upgrade the affected component.

Related

Alias · CVE (1)

  • CVE-2025-5174 A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References