{"action":"Upgrade picklescan to 0.0.27 or later.","affected":[{"fixed":"0.0.27","introduced":"0"}],"component":"picklescan","cve_ids":["CVE-2025-71325"],"ecosystem":"PyPI","epss":0.00604,"exploited":false,"fixed_versions":["0.0.27"],"ghsa_id":"GHSA-9gvj-pp9x-gcfr","id":"tcs_01M5KFAW5KHGX2E7ZVJK5JVC17","modified_at":"2026-07-07T17:56:08.463569338Z","published_at":"2025-08-12T00:13:55Z","references":["https://osv.dev/vulnerability/GHSA-9gvj-pp9x-gcfr","https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9gvj-pp9x-gcfr","https://nvd.nist.gov/vuln/detail/CVE-2025-71325","https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0f","https://github.com/mmaitre314/picklescan/commit/58983e1c20973ac42f2df7ff15d7c8cd32f9b688","https://github.com/mmaitre314/picklescan","https://github.com/mmaitre314/picklescan/blob/2a8383cfeb4158567f9770d86597300c9e508d0f/src/picklescan/scanner.py#L255","https://github.com/mmaitre314/picklescan/blob/2a8383cfeb4158567f9770d86597300c9e508d0f/src/picklescan/scanner.py#L281","https://github.com/mmaitre314/picklescan/releases/tag/v0.0.27","https://www.vulncheck.com/advisories/picklescan-detection-bypass-via-stack-global-opcode-parsing-logic-flaw"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-9gvj-pp9x-gcfr","url":"https://osv.dev/vulnerability/GHSA-9gvj-pp9x-gcfr"},{"source":"nvd","source_id":"CVE-2025-71325","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71325"}],"summary":"Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass"}