---
id: CVE-2025-71320
title: >-
  picklescan before 0.0.33 contains an incomplete deny-list that fails to block
  pydoc.locate and operator.methodcaller functions, allowing attackers to bypass
  security checks
summary: >-
  picklescan before 0.0.33 contains an incomplete deny-list that fails to block
  pydoc.locate and operator.methodcaller functions, allowing attackers to bypass
  security checks. Remote attackers can craft malicious pickle files using these
  u…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-184
vendor: picklescan
product: picklescan
affected:
  - picklescan < 0.0.33
patched:
  - picklescan 0.0.33
published: '2026-06-17'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T22:10:00.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71320'
references:
  - url: >-
      https://github.com/mmaitre314/picklescan/security/advisories/GHSA-84r2-jw7c-4r5q
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-incomplete-disallowed-inputs
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/mmaitre314/picklescan/security/advisories/GHSA-84r2-jw7c-4r5q
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71320'
  - url: 'https://github.com/mmaitre314/picklescan/pull/53'
  - url: >-
      https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab
  - url: 'https://github.com/mmaitre314/picklescan'
  - url: 'https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33'
tags:
  - nvd
  - osv
  - pip
epss: 0.00823
epssPercentile: 0.57133
aliases:
  - GHSA-84r2-jw7c-4r5q
  - PYSEC-2026-1785
ecosystem: pip
ingestedAt: '2026-07-08T18:25:47.300Z'
---

## Overview

picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when the pickle is deserialized.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2025-71320)

Affected packages:

- `picklescan < 0.0.33`

Patched in:

- `picklescan 0.0.33`

Source: https://osv.dev/vulnerability/GHSA-84r2-jw7c-4r5q