Description
A vulnerability was found in erdogant pypickle up to 1.1.5. It has been classified as critical. This affects the function Save of the file pypickle/pypickle.py. The manipulation leads to improper authorization. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named 14b4cae704a0bb4eb6723e238f25382d847a1917. It is recommended to upgrade the affected component.
Published: 2025-05-26
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-16266 pypickle Incorrect Privilege Assignment vulnerability
Github GHSA Github GHSA GHSA-qpxx-2cwh-r5vh pypickle Incorrect Privilege Assignment vulnerability
History

Wed, 04 Jun 2025 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Erdogant
Erdogant pypickle
Weaknesses NVD-CWE-Other
CPEs cpe:2.3:a:erdogant:pypickle:*:*:*:*:*:*:*:*
Vendors & Products Erdogant
Erdogant pypickle

Wed, 28 May 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 May 2025 07:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in erdogant pypickle up to 1.1.5. It has been classified as critical. This affects the function Save of the file pypickle/pypickle.py. The manipulation leads to improper authorization. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named 14b4cae704a0bb4eb6723e238f25382d847a1917. It is recommended to upgrade the affected component.
Title erdogant pypickle pypickle.py save improper authorization
Weaknesses CWE-266
CWE-285
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Erdogant Pypickle
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2025-05-28T17:36:15.929Z

Reserved: 2025-05-25T13:47:05.776Z

Link: CVE-2025-5175

cve-icon Vulnrichment

Updated: 2025-05-27T14:19:03.232Z

cve-icon NVD

Status : Analyzed

Published: 2025-05-26T08:15:19.463

Modified: 2025-06-03T15:43:45.590

Link: CVE-2025-5175

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses