CVE-2025-71378 — picklescan - Remote Code Execution via Undetected cProfile.runctx in Pickle Files
picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypas…
Published: 2026-06-21 · CVSS: 7.6 · CVSS 4.0
picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7