CVE-2025-71373highCWE-693

CVE-2025-71373: high-severity vulnerability in picklescan

picklescan - Remote Code Execution via operator.methodcaller Detection Bypass

Published · Updated

Follow this CVE+ Monitor picklescan+ Monitor picklescan

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.6epss 0.6%
picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on picklescan for validation.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
picklescan · picklescan
Related CVEs — picklescan

In the same product, most dangerous first.

CVE-2026-56315CRITICALpicklescan - Remote Code Execution via Unblocked Standard Library ModulesEPSS 1.1%CVE-2025-71323CRITICALpicklescan - Remote Code Execution via Unblocked ctypes ModuleEPSS 1.0%CVE-2025-71368HIGHpicklescan - Arbitrary Code Execution via Undetected doctest.debug_scriptEPSS 0.8%CVE-2025-71321CRITICALpicklescan - Arbitrary File Writing via distutils Module BypassEPSS 0.8%CVE-2026-3490CRITICALpicklescan - Universal Blocklist Bypass via pkgutil.resolve_nameEPSS 0.8%CVE-2025-71320CRITICALpicklescan - Remote Code Execution via Incomplete Disallowed InputsEPSS 0.8%