CVE-2025-71344: picklescan - Arbitrary Code Execution via Undetected ensurepip._run_pip Function
picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip.runpip built-in function when scanning pickle files, allowing attackers to execute arbitrary code. Malicious pickle files embedding ensurepip.runpip calls in reduce methods bypass picklescan detection and achieve remote code execution upon pickle.load() invocation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
picklescanto a version that resolves this vulnerability.Fixed in 0.0.30
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71344?
The severity of CVE-2025-71344 is rated high with a score of 7.6.
How do I fix CVE-2025-71344?
To mitigate CVE-2025-71344, upgrade picklescan to version 0.0.30 or later.
What does CVE-2025-71344 allow attackers to do?
CVE-2025-71344 allows attackers to execute arbitrary code via malicious pickle files that call the ensurepip._run_pip function.
Which versions of picklescan are affected by CVE-2025-71344?
Versions of picklescan that are affected by CVE-2025-71344 are 0.0.26 and earlier.
How can I prevent exploitation of CVE-2025-71344 in my application?
To prevent exploitation of CVE-2025-71344, ensure that your application uses the updated version of picklescan and avoid processing untrusted pickle files.