CVE-2025-71371

picklescan - Remote Code Execution via code.InteractiveInterpreter Detection Bypass

CVSS 7.6 HIGHEPSS 0.5%CWE-502

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.6EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

30 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected products

picklescan · picklescan

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/mmaitre314/picklescan/security/advisories/GHSA-cj3c-v495-4xqh https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-code-interactiveinterpreter-detection-bypass