PyPI/pypickle CVE-2025-5174: medium 5.3, EPSS 0.34%

pypickle unsafe deserialization vulnerability

Action: Upgrade pypickle to 2.0.0 or later.

pip install pypickle==2.0.0

Affected

Fixed versions

Sources

• osv: GHSA-5qwj-342r-h886
• https://nvd.nist.gov/vuln/detail/CVE-2025-5174
• https://github.com/erdogant/pypickle/issues/2
• https://github.com/erdogant/pypickle/issues/2#issuecomment-2889146579
• https://github.com/erdogant/pypickle/commit/14b4cae704a0bb4eb6723e238f25382d847a1917
• https://github.com/erdogant/pypickle
• https://github.com/erdogant/pypickle/releases/tag/2.0.0
• https://github.com/pypa/advisory-database/tree/main/vulns/pypickle/PYSEC-2025-45.yaml
• https://vuldb.com/?ctiid.310262
• https://vuldb.com/?id.310262
• https://vuldb.com/?submit.579157

CVE-2025-5174 · published 2025-05-26T09:30:45Z · modified 2025-06-04T21:29:09.540972Z · JSON