VULNERABILITY INTELLIGENCE
CVE-2025-71371
CVSS score8.1 HIGH
EPSS probability0.57%
CISA KEVNot currently listed
Published2026-06-30
Last modified2026-10-12
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Description
picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().
Weakness classification
- disclosure@vulncheck.com: CWE-502