picklescan – Remote Code Execution via Undetected profile.Profile.runctx_CVE-2025-71341

7.6 / 10

HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Description

picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to achieve remote code execution when the pickle file is loaded.

Basic Information

ID CVE-2025-71341

Source VulnCheck

Published Jun 23, 2026 at 12:12

Affected Product

Vendor picklescan

Product picklescan

Affected Versions picklescan picklescan 0

CWE Classification

CWE-502

References

{
    "lastseen": "",
    "description": "picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to achieve remote code execution when the pickle file is loaded.",
    "published": "2026-06-23T12:12:53.207Z",
    "modified": "2026-06-23T12:12:53.207Z",
    "type": "cve",
    "title": "picklescan - Remote Code Execution via Undetected profile.Profile.runctx",
    "source": "VulnCheck",
    "references": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-6vqj-c2q5-j97w\nhttps://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-undetected-profile-profile-runctx",
    "id": "CVE-2025-71341",
    "bulletinFamily": "",
    "cwe": [
        "CWE-502"
    ],
    "cvelist": null,
    "sourceData": "picklescan picklescan 0",
    "sourceHref": "",
    "cvss": {
        "score": 7.6,
        "severity": "HIGH",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "picklescan",
    "version": "0",
    "vendor": "picklescan",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}