Veille CVE
CVE-2025-71357
7.8 ÉlevéeDescription
picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 4.0 | 7.6 Élevée | disclosure@vulncheck.com | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| 3.1 | 8.1 Élevée | disclosure@vulncheck.com | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| 3.1 | 7.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-j343-8v2j-ff7w ExploitVendor Advisory
- https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-undetected-idlelib-pyshell-modifiedinterpreter-runcommand Third Party Advisory
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-j343-8v2j-ff7w ExploitVendor Advisory