---
id: CVE-2025-71354
title: >-
  picklescan before 0.0.29 fails to detect malicious pickle files that exploit
  idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods
summary: >-
  picklescan before 0.0.29 fails to detect malicious pickle files that exploit
  idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers
  can craft pickle files with embedded code that bypasses picklescan detection
  and e…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-502
vendor: picklescan
product: picklescan
affected:
  - picklescan < 0.0.29
patched:
  - picklescan 0.0.29
published: '2026-06-24'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T21:10:00.227'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71354'
references:
  - url: >-
      https://github.com/mmaitre314/picklescan/security/advisories/GHSA-3vg9-h568-4w9m
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-idlelib-debugobj-objecttreeitem-settext
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/mmaitre314/picklescan/security/advisories/GHSA-3vg9-h568-4w9m
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://github.com/mmaitre314/picklescan/commit/aecd11be98702caa9ba9b12189d91ad596a36114
  - url: 'https://github.com/mmaitre314/picklescan'
tags:
  - nvd
  - osv
  - pip
epss: 0.00449
epssPercentile: 0.39129
aliases:
  - GHSA-3vg9-h568-4w9m
  - PYSEC-2026-1781
ecosystem: pip
ingestedAt: '2026-07-08T18:25:45.152Z'
---

## Overview

picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can craft pickle files with embedded code that bypasses picklescan detection and executes arbitrary commands when pickle.load() is called.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2025-71354)

Affected packages:

- `picklescan < 0.0.29`

Patched in:

- `picklescan 0.0.29`

Source: https://osv.dev/vulnerability/GHSA-3vg9-h568-4w9m