Skip to content
OpenAdvisories

Archive

26 February 2025

Vulnerabilities first published on this day (UTC), newest first.

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2025-1716 Public exploit

    picklescan - Security scanning bypass via 'pip main'

    picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted gl…