CVE-2025-5174CWE-20CWE-502

erdogant pypickle pypickle.py load deserialization

Medium · published May 26, 2025

CVSS v4.0
4.8
EPSS
0%
Percentile
25.9
In the wild
Unconfirmed
What it is

A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. Affected by this issue is the function load of the file pypickle/pypickle.py. The manipulation leads to deserialization. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 14b4cae704a0bb4eb6723e238f25382d847a1917. It is recommended to upgrade the affected component.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00337 · 25.9th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-502 · Deserialization of Untrusted Data
Published
2025-05-26T07:00Z
EPSS history
Timeline
  • 26 MAY 07:00Z
    erdogant pypickle pypickle.py load deserialization
    cvelistv5