CVE-2025-71322: PickleScan - Unsafe Globals Check Bypass via pty.spawn Function
PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. Malicious actors can craft pickle payloads using pty.spawn to achieve arbitrary code execution when files are processed by PickleScan.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PickleScanto a version that resolves this vulnerability.Fixed in 0.0.33 - Configuration
Add 'pty.spawn' to PickleScan's unsafe_globals list so that pty.spawn is treated as unsafe and cannot be used in processed pickle payloads.
PickleScan unsafe_globals = include pty.spawn
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71322?
The severity of CVE-2025-71322 is high with a score of 8.7.
How do I fix CVE-2025-71322?
To fix CVE-2025-71322, upgrade PickleScan to version 0.0.33 or later.
What type of vulnerability is CVE-2025-71322?
CVE-2025-71322 is an unsafe globals check bypass vulnerability.
What impact does CVE-2025-71322 have on security?
CVE-2025-71322 allows an attacker to achieve arbitrary code execution through crafted pickle payloads.
Which function is related to CVE-2025-71322?
The pty.spawn function is related to CVE-2025-71322 and is missing from the unsafe globals list.