5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-5174

CVE-2025-5174: pypickle unsafe deserialization vulnerability

A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic. Affected by this issue is the function load of the file pypickle/pypickle.py. The manipulation leads to deserialization. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 14b4cae704a0bb4eb6723e238f25382d847a1917. It is recommended to upgrade the affected component.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-5174

CVE-2025-5174:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pypickle	pip	< 2.0.0	2.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability existed in the pypickle library prior to version 2.0.0, specifically within its deserialization mechanism. The core issue was that the main pypickle.pypickle.load function provided an option (safe=False) to bypass its default safer unpickling process. When safe=False was used, load would delegate the deserialization to an internal helper function, pypickle.pypickle.load_unsafe.

The load_unsafe function then used Python's built-in pickle.load directly, without any checks on the content being deserialized. This is a well-known security risk, as specially crafted pickle files can execute arbitrary code upon deserialization.

Thus, an attacker with local access (to provide a malicious pickle file) could exploit this by calling pypickle.load('malicious.pkl', safe=False), leading to potential code execution. Both load (for allowing the unsafe path) and load_unsafe (for performing the unsafe deserialization) were critical to the vulnerability.

The patch (commit 14b4cae704a0bb4eb6723e238f25382d847a1917) remediated this by:

Removing the load_unsafe function entirely.
Replacing the boolean safe parameter in the load function with a more robust validate parameter and an allowlist mechanism.
Introducing a ValidateUnpickler class that checks for allowed modules before actual deserialization occurs, even if full validation is requested.

If validate=False is used in the patched version, load_pickle (a new function similar to the old load_unsafe) is called, but this is now an explicit choice to disable security measures, rather than an easily overlooked bypass of a safe default. The vulnerable path involved the safe=False parameter in the load function leading to the execution of the now-removed load_unsafe function.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.