CVE-2025-71341: picklescan - Remote Code Execution via Undetected profile.Profile.runctx
Published Jun 23, 2026
·Updated
picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to achieve remote code execution when the pickle file is loaded.
Affected Software
1 affected component
pypi/picklescan<0.0.29
Event History
Jun 23, 2026
CVE Published
via MITRE·12:12 PM
Data Sourced
via MITRE·12:12 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-71341?
CVE-2025-71341 has a high severity rating of 8.1.
2
How do I fix CVE-2025-71341?
To fix CVE-2025-71341, upgrade to version 0.0.29 or later of the picklescan software.
3
What type of vulnerability is CVE-2025-71341?
CVE-2025-71341 is a remote code execution vulnerability.
4
What software is affected by CVE-2025-71341?
The affected software by CVE-2025-71341 is picklescan, specifically versions prior to 0.0.29.
5
What can attackers achieve using CVE-2025-71341?
Attackers can achieve remote code execution through maliciously crafted pickle files using the profile.Profile.runctx function.