CVE-2025-69872: DiskCache has unsafe pickle deserialization

February 11, 2026 (updated February 12, 2026)

DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.

References

github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69872-DiskCache-Pickle-Deserialization.md
github.com/advisories/GHSA-w8v5-vhqr-4h9v
github.com/grantjenks/python-diskcache
nvd.nist.gov/vuln/detail/CVE-2025-69872

Code Behaviors & Features

Detect and mitigate CVE-2025-69872 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →