CVE-2025-71322CWE-693

CVE-2025-71322

High · published June 17, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
31.2
In the wild
Unconfirmed
What it is

PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. Malicious actors can craft pickle payloads using pty.spawn to achieve arbitrary code execution when files are processed by PickleScan.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00384 · 31.2th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2026-06-17T21:16Z
References (3)
https://github.com/mmaitre314/picklescan/security/advisories/GHSA-hgrh-qx5j-jfwx · [email protected]https://www.vulncheck.com/advisories/picklescan-unsafe-globals-check-bypass-via-pty-spawn-function · [email protected]https://github.com/mmaitre314/picklescan/security/advisories/GHSA-hgrh-qx5j-jfwx · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 JUN 15:04Z
    PickleScan - Unsafe Globals Check Bypass via pty.spawn Function
    cvelistv5