CVE-2025-71378

picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().

CVSS 4.0

7.6CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-25)

CWE

CWE-502

Published

2026-06-21

Modified

2026-10-12

Record from

the NVD, synced 2026-10-19

Affected

• mmaitre314:picklescan

Packages (OSV)

References

• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9w88-8rmg-7g2p
• https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-undetected-cprofile-runctx-in-pickle-files
• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9w88-8rmg-7g2p

Check your stackJSON