---
id: CVE-2025-71355
title: >-
  Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy
  library, allowing attackers to bypass static analysis and execute arbitrary
  code during deserialization
summary: >-
  Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy
  library, allowing attackers to bypass static analysis and execute arbitrary
  code during deserialization. Attackers can craft malicious pickle files using
  numpy…
severity: medium
cwe:
  - CWE-184
vendor: picklescan
product: picklescan
affected:
  - picklescan < 0.0.25
patched:
  - picklescan 0.0.25
published: '2026-06-30'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T21:10:00.227'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71355'
references:
  - url: >-
      https://github.com/mmaitre314/picklescan/security/advisories/GHSA-fj43-3qmq-673f
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-unsafe-numpy-function-detection-bypass
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/mmaitre314/picklescan/security/advisories/GHSA-fj43-3qmq-673f
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/mmaitre314/picklescan'
tags:
  - nvd
  - osv
  - pip
epss: 0.00628
epssPercentile: 0.50231
aliases:
  - GHSA-fj43-3qmq-673f
ecosystem: pip
ingestedAt: '2026-07-08T18:25:48.917Z'
---

## Overview

Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and execute arbitrary code during deserialization. Attackers can craft malicious pickle files using numpy.testing._private.utils.runstring within the reduce method to import dangerous libraries like os and execute arbitrary OS commands when the pickle file is loaded.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2025-71355)

Affected packages:

- `picklescan < 0.0.25`

Patched in:

- `picklescan 0.0.25`

Source: https://osv.dev/vulnerability/GHSA-fj43-3qmq-673f