CVE-2025-71374 — picklescan - Arbitrary Code Execution via Undetected profile.Profile.run
picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arbitrary code. Remot…
Published: 2026-06-30 · CVSS: 7.6 · CVSS 4.0
picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files that bypass picklescan detection and achieve code execution upon deserialization.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7