CVE-2025-5174

Katalog CVE

CVSS 7.8 · High EPSS 0,32%

Kerentanan Improper Input Validation pada erdogant pypickle. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. Affected by this issue is the function load of the file pypickle/pypickle.py. The manipulation leads to deserialization. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 14b4cae704a0bb4eb6723e238f25382d847a1917. It is recommended to upgrade the affected component.

Rincian

Terbit di NVD

26 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/erdogant/pypickle/issues/2 exploit · issue tracking · advisory vendor
• https://github.com/erdogant/pypickle/issues/2#issuecomment-2889146579 exploit · issue tracking · advisory vendor
• https://github.com/erdogant/pypickle/commit/14b4cae704a0bb4eb6723e238f25382d847a1917 patch
• https://vuldb.com/?id.310262 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.579157 advisory pihak ketiga · vdb entry
• https://github.com/erdogant/pypickle/releases/tag/2.0.0 release notes
• https://vuldb.com/?ctiid.310262 permissions required · vdb entry