{"cve":"CVE-2025-71325","nvd":{"published":"2026-06-17T17:16:41.247","modified":"2026-10-12T22:10:00.247","status":"Deferred","description":"picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files with arguments at position zero to trigger unexpected exceptions and evade security scanning.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-391"],"references":["https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0f","https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9gvj-pp9x-gcfr","https://www.vulncheck.com/advisories/picklescan-detection-bypass-via-stack-global-opcode-parsing-logic-flaw","https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9gvj-pp9x-gcfr"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:39:28.638635428+00:00"},"epss":{"cve":"CVE-2025-71325","score":0.00604,"percentile":0.48587,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-9gvj-pp9x-gcfr","url":"https://osv.dev/vulnerability/GHSA-9gvj-pp9x-gcfr","summary":"Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass","modified":"2026-07-07T17:56:08.463569338Z","packages":[{"ecosystem":"PyPI","name":"picklescan","purl":"pkg:pypi/picklescan","ranges":["<0.0.27"],"fixed":["0.0.27"]}]},{"id":"PYSEC-2026-1788","url":"https://osv.dev/vulnerability/PYSEC-2026-1788","summary":"Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass","modified":"2026-07-07T17:48:02.274733668Z","packages":[{"ecosystem":"PyPI","name":"picklescan","purl":"pkg:pypi/picklescan","ranges":["<0.0.27"],"fixed":["0.0.27"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}