CVE-2025-5174 MEDIUM

CVE-2025-5174: erdogant pypickle pypickle.py load deserialization

Vendor Erdogant
Product pypickle
Weakness CWE-502 · Unsafe deserialization
Published May 26, 2025
Last update May 28, 2025

CVSS base score

4.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. Affected by this issue is the function load of the file pypickle/pypickle.py. The manipulation leads to deserialization. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 14b4cae704a0bb4eb6723e238f25382d847a1917. It is recommended to upgrade the affected component.

Key dates

02Disclosure timeline

May 26, 2025 CVE published
May 28, 2025 Record updated