CVE-2025-71351
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands.
Risk Assessment
The organization is exposed to remote code execution, which can lead to serious security breaches and data loss. Unauthorized system commands execution may threaten the integrity of systems.
Recommendation
It is recommended to update picklescan to version 0.0.25 or later to mitigate this vulnerability. An audit of pickle files should also be conducted to detect potential threats.
Original NVD description (English source)
picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands, which evade picklescan detection and execute when pickle.load() is called.