PT-2026-50455 · Picklescan · Picklescan

Lyutoon · Publicado 2026-06-17 · Atualizado 2026-06-17 · CVE-2025-71325

Mitre

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

picklescan before 0.0.27 contains a parsing logic error in the list globals function when handling STACK GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files with arguments at position zero to trigger unexpected exceptions and evade security scanning.

Exploit

Correção

Enumeração de Fraquezas

CWE-391

Identificadores relacionados

CVE-2025-71325

Produtos afetados

Picklescan

Referências · 3

• 🔥 https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9gvj-pp9x-gcfr · Exploit
• https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0f · Correção
• https://vulncheck.com/advisories/picklescan-detection-bypass-via-stack-global-opcode-parsing-logic-flaw · Nota