Vulnerability DatabaseCVE-2025-5174

CVE-2025-5174:
Python vulnerability analysis and mitigation

Overview

A vulnerability was discovered in erdogant pypickle up to version 1.1.5, identified as CVE-2025-5174. The issue affects the load function in pypickle/pypickle.py and is related to insecure deserialization that could lead to remote code execution. The vulnerability was disclosed on May 16, 2025, and a fix was released in version 2.0.0 (Github Issue, NVD).

Technical details

The vulnerability stems from the load() function using Python's pickle.load() without proper input validation or sanitization. This implementation allows for unsafe deserialization of untrusted data, which can lead to arbitrary code execution. The vulnerability has been assigned CVSS v3.1 Base Score of 5.3 (MEDIUM) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The issue is classified under CWE-502 (Deserialization of Untrusted Data) and CWE-20 (Improper Input Validation) (NVD).

Impact

The vulnerability allows attackers to execute arbitrary code when a malicious pickle file is loaded. This can lead to remote system compromise and arbitrary command execution on the affected system. The attack requires local access to be successful (Github Issue).

Mitigation and workarounds

The vulnerability has been fixed in pypickle version 2.0.0. The update includes several security mechanisms: implementation of validation checks for high-risk modules before loading, restrictions on save locations, and path traversal detection. Users are strongly recommended to upgrade to version 2.0.0. The patch is identified as 14b4cae704a0bb4eb6723e238f25382d847a1917 (Github Release).

Additional resources

Source: This report was generated using AI

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues

Cloud threat landscape

A comprehensive threat intelligence database of cloud security incidents, actors, tools and techniques

PEACH

A step-by-step framework for modeling and improving SaaS and PaaS tenant isolation

Get a personalized demo

Ready to see Wiz in action?

“Best User Experience I have ever seen, provides full visibility to cloud workloads.”

David EstlickCISO

“Wiz provides a single pane of glass to see what is going on in our cloud environments.”

Adam FletcherChief Security Officer

“We know that if Wiz identifies something as critical, it actually is.”

Greg PoniatowskiHead of Threat and Vulnerability Management

Get a demo