Количество 2
Количество 2
CVE-2025-71344
picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing attackers to execute arbitrary code. Malicious pickle files embedding ensurepip._run_pip calls in __reduce__ methods bypass picklescan detection and achieve remote code execution upon pickle.load() invocation.
GHSA-xp4f-hrf8-rxw7
Picklescan is missing detection when calling built-in python ensurepip._run_pip
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2025-71344 picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing attackers to execute arbitrary code. Malicious pickle files embedding ensurepip._run_pip calls in __reduce__ methods bypass picklescan detection and achieve remote code execution upon pickle.load() invocation. | CVSS3: 8.1 | 1% Низкий | около 2 месяцев назад |
| GHSA-xp4f-hrf8-rxw7 Picklescan is missing detection when calling built-in python ensurepip._run_pip | CVSS3: 8.1 | 1% Низкий | 12 месяцев назад |
Уязвимостей на страницу