---
id: CVE-2025-71371
title: >-
  picklescan before 0.0.29 fails to detect malicious pickle files using
  code.InteractiveInterpreter.runcode in reduce methods
summary: >-
  picklescan before 0.0.29 fails to detect malicious pickle files using
  code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft
  pickle payloads that bypass picklescan detection and execute arbitrary code
  when loaded via …
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-502
vendor: picklescan
product: picklescan
affected:
  - picklescan < 0.0.29
patched:
  - picklescan 0.0.29
published: '2026-06-30'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T21:10:00.227'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71371'
references:
  - url: >-
      https://github.com/mmaitre314/picklescan/security/advisories/GHSA-cj3c-v495-4xqh
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-code-interactiveinterpreter-detection-bypass
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/mmaitre314/picklescan/security/advisories/GHSA-cj3c-v495-4xqh
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://github.com/mmaitre314/picklescan/commit/aecd11be98702caa9ba9b12189d91ad596a36114
  - url: 'https://github.com/mmaitre314/picklescan'
tags:
  - nvd
  - osv
  - pip
epss: 0.00567
epssPercentile: 0.46852
aliases:
  - GHSA-cj3c-v495-4xqh
ecosystem: pip
ingestedAt: '2026-07-08T18:25:48.390Z'
---

## Overview

picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2025-71371)

Affected packages:

- `picklescan < 0.0.29`

Patched in:

- `picklescan 0.0.29`

Source: https://osv.dev/vulnerability/GHSA-cj3c-v495-4xqh