PT-2025-22916 · Pypi · Pypickle

Esharmaji · Published 2025-05-26 · Updated 2025-05-26 · CVE-2025-5174

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions erdogant pypickle versions 1.1.5 and earlier

Description A vulnerability was found in erdogant pypickle, classified as problematic. The issue affects the load function of the file pypickle/pypickle.py, leading to deserialization. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Recommendations For erdogant pypickle versions 1.1.5 and earlier, upgrade to version 2.0.0 to address this issue. As a temporary workaround, consider restricting access to the load function of the pypickle/pypickle.py file until the upgrade is applied.

Exploit

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-5174

GHSA-5QWJ-342R-H886

PYSEC-2025-45

Affected Products

Pypickle

References · 15

• 🔥 https://github.com/erdogant/pypickle/issues/2 · Exploit
• https://github.com/erdogant/pypickle/issues/2#issuecomment-2889146579 · Vendor Advisory
• https://github.com/erdogant/pypickle/releases/tag/2.0.0 · Patch
• https://github.com/erdogant/pypickle/commit/14b4cae704a0bb4eb6723e238f25382d847a1917 · Patch
• https://osv.dev/vulnerability/CVE-2025-5174 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5174 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-45 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5qwj-342r-h886 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/pypickle/PYSEC-2025-45.yaml · Note
• https://github.com/erdogant/pypickle · Note
• https://t.me/cvetracker/24625 · Telegram Post
• https://vuldb.com/?ctiid.310262 · Note
• https://vuldb.com/?id.310262 · Note
• https://vuldb.com/?submit.579157 · Note
• https://twitter.com/CVEnew/status/1926901036876186091 · Twitter Post