CVE-2025-71378 | THREATINT

Description

picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().

PUBLISHED Reserved 2026-06-20 | Published 2026-06-21 | Updated 2026-06-23 | Assigner VulnCheck

HIGH: 7.6CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

HIGH: 8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Problem types

Deserialization of Untrusted Data

Product status

Default status

unaffected

Any version before 0.0.30

affected

0.0.30 (semver)

unaffected

Credits

FredericDT reporter

References

github.com/...lescan/security/advisories/GHSA-9w88-8rmg-7g2p exploit

github.com/...lescan/security/advisories/GHSA-9w88-8rmg-7g2p (GHSA Advisory GHSA-9w88-8rmg-7g2p) vendor-advisory

www.vulncheck.com/...etected-cprofile-runctx-in-pickle-files (VulnCheck Advisory: picklescan - Remote Code Execution via Undetected cProfile.runctx in Pickle Files) third-party-advisory

cve.org (CVE-2025-71378)

nvd.nist.gov (CVE-2025-71378)

Download JSON