CVE-2025-71371CWE-502insecure-deserialization

CVE-2025-71371

High · published July 1, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
46.3
In the wild
Unconfirmed
What it is

picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00567 · 46.3th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-07-01T03:16Z
References (3)
https://github.com/mmaitre314/picklescan/security/advisories/GHSA-cj3c-v495-4xqh · [email protected]https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-code-interactiveinterpreter-detection-bypass · [email protected]https://github.com/mmaitre314/picklescan/security/advisories/GHSA-cj3c-v495-4xqh · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 JUN 22:08Z
    picklescan - Remote Code Execution via code.InteractiveInterpreter Detection Bypass
    cvelistv5