CVE-2025-71351

7.6 highEPSS 0.6%

picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands, which evade picklescan detection and execute when pickle.load() is called.

CVSS 4.0: 7.6CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS: 0.6% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-25)
CWE: CWE-184
Published: 2026-06-21
Modified: 2026-10-12
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-v7x6-rv5q-mhwc	PyPI	picklescan	<0.0.25	0.0.25
PYSEC-2026-4135	PyPI	picklescan	<0.0.25	0.0.25

References

https://github.com/mmaitre314/picklescan/security/advisories/GHSA-v7x6-rv5q-mhwc
https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-timeit-timeit-detection-bypass
https://github.com/mmaitre314/picklescan/security/advisories/GHSA-v7x6-rv5q-mhwc

Check your stack JSON