CVE-2025-71344 — picklescan - Arbitrary Code Execution via Undetected ensurepip._run_pip Function
picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing attackers to execut…
Published: 2026-06-22 · CVSS: 7.6 · CVSS 4.0
picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing attackers to execute arbitrary code. Malicious pickle files embedding ensurepip._run_pip calls in __reduce__ methods bypass picklescan detection and achieve remote code execution upon pickle.load() invocation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7