CVE-2025-5174

erdogant pypickle pypickle.py load deserialization

State: Published
Severity: 4.8 Medium
Published: May 26, 2025
Updated: May 28, 2025
Reserved: May 25, 2025

Description

A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. Affected by this issue is the function load of the file pypickle/pypickle.py. The manipulation leads to deserialization. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 14b4cae704a0bb4eb6723e238f25382d847a1917. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
2.0	4.3 Medium	AV:L/AC:L/Au:S/C:P/I:P/A:P	VulDB

Weaknesses

CWE-502 Deserialization
CWE-20 Improper Input Validation

Affected Products

Product	Versions
pypickleerdogant	1.1.0Affected 1.1.1Affected 1.1.2Affected 1.1.3Affected 1.1.4Affected 1.1.5Affected

References

VDB-310262 | erdogant pypickle pypickle.py load deserializationvdb-entrytechnical-description
VDB-310262 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #579157 | erdogant pypickle 1.1.5 Insecure Deserializationthird-party-advisory
https://github.com/erdogant/pypickle/issues/2exploitissue-tracking
https://github.com/erdogant/pypickle/issues/2#issuecomment-2889146579issue-tracking
https://github.com/erdogant/pypickle/commit/14b4cae704a0bb4eb6723e238f25382d847a1917patch
https://github.com/erdogant/pypickle/releases/tag/2.0.0patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.