CVE-2025-71320
CRITICAL SEVERITYCVSS Score & Metrics
Base Score
9.8 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Description
picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when the pickle is deserialized.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-184
Source
NVD
Vendor
picklescan
Product
picklescan
Discussion (0)
Add Comment
No comments yet. Be the first!