CVE-2025-71321
CriticalCVSS 9.8Summary
Picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist. Attackers can construct malicious pickle objects to overwrite critical system files.
Risk Assessment
This vulnerability can lead to denial of service or remote code execution, posing a serious threat to the integrity and availability of the system.
Recommendation
It is recommended to update picklescan to version 0.0.33 or later to mitigate this vulnerability.
Original NVD description (English source)
picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util.write_file. Attackers can construct malicious pickle objects to overwrite critical system files and achieve denial of service or remote code execution.