{"id":"CVE-2025-71371","title":"picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods","summary":"picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via …","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cwe":["CWE-502"],"vendor":"picklescan","product":"picklescan","affected":["picklescan < 0.0.29"],"patched":["picklescan 0.0.29"],"published":"2026-06-30","updated":"2026-10-12","sourceUpdated":"2026-10-12T21:10:00.227","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71371","references":[{"url":"https://github.com/mmaitre314/picklescan/security/advisories/GHSA-cj3c-v495-4xqh","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-code-interactiveinterpreter-detection-bypass","label":"disclosure@vulncheck.com"},{"url":"https://github.com/mmaitre314/picklescan/security/advisories/GHSA-cj3c-v495-4xqh","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/mmaitre314/picklescan/commit/aecd11be98702caa9ba9b12189d91ad596a36114"},{"url":"https://github.com/mmaitre314/picklescan"}],"tags":["nvd","osv","pip"],"epss":0.00567,"epssPercentile":0.46852,"aliases":["GHSA-cj3c-v495-4xqh"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:48.390Z","slug":"CVE-2025-71371","body":"## Overview\n\npicklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2025-71371)\n\nAffected packages:\n\n- `picklescan < 0.0.29`\n\nPatched in:\n\n- `picklescan 0.0.29`\n\nSource: https://osv.dev/vulnerability/GHSA-cj3c-v495-4xqh","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":213793,"id":"CVE-2025-71371","ts":1790788491328,"field":"cvss","old":null,"new":"8.1"},{"seq":213792,"id":"CVE-2025-71371","ts":1790788491328,"field":"severity","old":"medium","new":"high"}]}