CVE-2025-71354CWE-502insecure-deserialization
CVE-2025-71354
High · published June 24, 2026
What it is
picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can craft pickle files with embedded code that bypasses picklescan detection and executes arbitrary commands when pickle.load() is called.
The record
Technical detail
- CVSS v3.1
- 8.1 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00449 · 38.0th percentile
- Weakness
- CWE-502 · Deserialization of Untrusted Data
- Published
- 2026-06-24T17:16Z
References (3)
EPSS history
Timeline