PyPI/picklescan CVE-2025-1716, CVE-2025-1889: critical 9.8, EPSS 1.72%

Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis

Action: Upgrade picklescan to 0.0.22 or later.

pip install picklescan==0.0.22

Affected

Fixed versions

Sources

• osv: GHSA-655q-fx9r-782v
• nvd: CVE-2025-1716
• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-655q-fx9r-782v
• https://github.com/mmaitre314/picklescan/commit/78ce704227c51f070c0c5fb4b466d92c62a7aa3d
• https://github.com/mmaitre314/picklescan
• https://github.com/pypa/advisory-database/tree/main/vulns/picklescan/PYSEC-2025-18.yaml
• https://sites.google.com/sonatype.com/vulnerabilities/cve-2025-1716

CVE-2025-1716, CVE-2025-1889 · published 2025-03-03T20:05:49Z · modified 2025-04-09T20:52:48.178566Z · JSON