CVE-2025-71357

PoC —

CVSS 4.0

7.6 high

EPSS

<1%p33

Published

Jun 21, 2026 (Jun 21, 2026)

Modified

Sep 11, 2026

Description

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

Vendors: mmaitre314
Products: picklescan
Ecosystems: pip
Weakness: CWE-502
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GHSA: GHSA-j343-8v2j-ff7w (high)

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.