CVE-2025-71341CWE-502insecure-deserialization

CVE-2025-71341

High · published June 23, 2026

CVSS v3.1

8.1

EPSS

Percentile

47.1

In the wild

Unconfirmed

What it is

picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to achieve remote code execution when the pickle file is loaded.

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00582 · 47.1th percentile
Weakness: CWE-502 · Deserialization of Untrusted Data
Published: 2026-06-23T17:16Z

References (3)

https://github.com/mmaitre314/picklescan/security/advisories/GHSA-6vqj-c2q5-j97w · [email protected]https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-undetected-profile-profile-runctx · [email protected]https://github.com/mmaitre314/picklescan/security/advisories/GHSA-6vqj-c2q5-j97w · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

23 JUN 12:12Z
picklescan - Remote Code Execution via Undetected profile.Profile.runctx
cvelistv5