HIGHCVSS 7.6EPSS 0.4%

CVE-2025-71357

CVE-2025-71357 updated by NVD

Published: 2025-08-26
Modified: 2026-10-14
EPSS percentile: 33%
Sources: github-advisory, nvd

Summary

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
PyPI	picklescan	—	0.0.30

Remediation: Upgrade to 0.0.30 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-71357

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.