CVE-2025-71343: picklescan - Arbitrary Code Execution via lib2to3.pgen2.pgen.ParserGenerator.make_label Detection Bypass
picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.makelabel function in the reduce method. Attackers can craft malicious pickle files with embedded code that evades detection but executes arbitrary commands when pickle.load() is called.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71343?
The severity of CVE-2025-71343 is classified as high with a score of 8.1.
How do I fix CVE-2025-71343?
To fix CVE-2025-71343, upgrade picklescan to version 0.0.30 or later.
What does CVE-2025-71343 exploit?
CVE-2025-71343 exploits a vulnerability in the lib2to3.pgen2.pgen.ParserGenerator.make_label function in picklescan.
What type of vulnerability is CVE-2025-71343?
CVE-2025-71343 is an arbitrary code execution vulnerability due to detection bypass of malicious pickle files.
What can attackers do with CVE-2025-71343?
Attackers can craft malicious pickle files that execute arbitrary commands when processed by vulnerable versions of picklescan.