A AegiFlow
HIGHCVSS 7.6EPSS 0.5%

CVE-2025-71378

CVE-2025-71378 updated by NVD

Published
2025-08-26
Modified
2026-10-14
EPSS percentile
40%
Sources
github-advisory, nvd

Summary

picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().

Affected packages

EcosystemPackageAffected versionsFixed versions
PyPIpicklescan—0.0.30

Remediation: Upgrade to 0.0.30 or later.

References

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.