Vulnerability · Published Apr 24, 2025 · Assigned by mitre
CVE-2025-46417
Medium 6.8
In plain English
A medium-severity security flaw in Picklescan from Picklescan. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)6.8Medium
Exploit odds (30 days)0.2%top 86.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltrate data via DNS after deserialization.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | picklescan | 0.0.25 | GHSA-93mv-x874-956g |
| PyPI | picklescan | 0.0.25 | PYSEC-2025-34 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Picklescan | Picklescan | 0 – before 0.0.25 |
Weakness: CWE-184 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N