CVE-2025-71351: picklescan - Remote Code Execution via timeit.timeit() Detection Bypass
Published Jun 21, 2026
·Updated
picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the reduce method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands, which evade picklescan detection and execute when pickle.load() is called.
Affected Software
1 affected component
pypi/picklescan<0.0.25
Event History
Jun 21, 2026
CVE Published
via MITRE·01:26 PM
Data Sourced
via MITRE·01:26 PM
DescriptionWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-71351?
CVE-2025-71351 has a high severity rating of 7.6 on the CVSS scale.
2
How do I fix CVE-2025-71351?
To fix CVE-2025-71351, upgrade picklescan to version 0.0.25 or later.
3
What can attackers do with CVE-2025-71351?
Attackers can exploit CVE-2025-71351 to execute arbitrary system commands through crafted malicious pickle files.
4
Which software is affected by CVE-2025-71351?
CVE-2025-71351 affects picklescan versions prior to 0.0.25.
5
What type of vulnerability is CVE-2025-71351?
CVE-2025-71351 is classified as a remote code execution vulnerability.