4 matches found
CVE-2025-71351
CVE-2025-71351 affects picklescan prior to version 0.0.25. The vulnerability arises because timeit.timeit() calls used in the reduce method are not detected by the tool, allowing crafted pickle payloads to bypass detection and trigger remote code execution when pickle.load() is performed. Attacke...
GHSA-F8H5-X737-X4XR `finch-rust` was removed from crates.io for malicious code
It depended on the sha-rust crate, which appeared to be attempting to steal credentials from local files...
Malicious Package
Overview syntax-flow is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...