{"action":"Upgrade picklescan to 0.0.27 or later.","affected":[{"fixed":"0.0.27","introduced":"0"}],"component":"picklescan","cve_ids":["CVE-2025-71325"],"ecosystem":"PyPI","epss":0.00604,"exploited":false,"fixed_versions":["0.0.27"],"ghsa_id":"GHSA-9gvj-pp9x-gcfr","id":"tcs_01M5KGVNZV3G4ZMAN8VDAY1APD","modified_at":"2026-07-07T17:48:02.274733668Z","published_at":"2026-07-07T16:03:00.934894Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1788","https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9gvj-pp9x-gcfr","https://nvd.nist.gov/vuln/detail/CVE-2025-71325","https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0f","https://github.com/mmaitre314/picklescan/commit/58983e1c20973ac42f2df7ff15d7c8cd32f9b688","https://github.com/mmaitre314/picklescan","https://github.com/mmaitre314/picklescan/blob/2a8383cfeb4158567f9770d86597300c9e508d0f/src/picklescan/scanner.py#L255","https://github.com/mmaitre314/picklescan/blob/2a8383cfeb4158567f9770d86597300c9e508d0f/src/picklescan/scanner.py#L281","https://github.com/mmaitre314/picklescan/releases/tag/v0.0.27","https://www.vulncheck.com/advisories/picklescan-detection-bypass-via-stack-global-opcode-parsing-logic-flaw","https://pypi.org/project/picklescan","https://github.com/advisories/GHSA-9gvj-pp9x-gcfr"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-1788","url":"https://osv.dev/vulnerability/PYSEC-2026-1788"},{"source":"nvd","source_id":"CVE-2025-71325","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71325"}],"summary":"Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass"}