CVE-2025-71349: picklescan - Arbitrary Code Execution via Undetected trace.Trace.run in Pickle Files
Published Jun 30, 2026
·Updated
picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using trace.Trace.run in the reduce method to achieve arbitrary code execution when pickle.load processes the file.
Affected Software
1 affected component
picklescan<0.0.29
Event History
Jun 30, 2026
CVE Published
via MITRE·10:08 PM
Data Sourced
via MITRE·10:08 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeakness
Jan 21, 58467
Event
via NVD·12:28 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-71349?
The severity of CVE-2025-71349 is rated high with a score of 7.6.
2
How do I fix CVE-2025-71349?
To fix CVE-2025-71349, update picklescan to version 0.0.29 or later.
3
What type of vulnerability is CVE-2025-71349?
CVE-2025-71349 is an arbitrary code execution vulnerability.
4
What causes the vulnerability in CVE-2025-71349?
The vulnerability in CVE-2025-71349 is caused by the failure of picklescan to detect the trace.Trace.run function when analyzing pickle files.
5
Who can exploit CVE-2025-71349?
Remote attackers can exploit CVE-2025-71349 by crafting malicious pickle files.