VULNERABILITY INTELLIGENCE

CVE-2025-71357

CVSS score8.1 HIGH
EPSS probability0.39%
CISA KEVNot currently listed
Published2026-06-21
Last modified2026-10-12
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Description

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

Weakness classification

  • disclosure@vulncheck.com: CWE-502

Primary references