Vulnerability Description
picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files with arguments at position zero to trigger unexpected exceptions and evade security scanning.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9gvj-pp9x-gcfr
- https://www.vulncheck.com/advisories/picklescan-detection-bypass-via-stack-globa
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9gvj-pp9x-gcfr
FAQ
What is CVE-2025-71325?
CVE-2025-71325 is a vulnerability with a CVSS score of 9.8 (CRITICAL). picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle ...
How severe is CVE-2025-71325?
CVE-2025-71325 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-71325?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.