CVE-2025-71352: picklescan - Remote Code Execution via Undetected trace.Trace.runctx in Pickle Files
picklescan before 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used in pickle file reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with trace.Trace.runctx payloads that bypass picklescan detection and execute code upon pickle.load() invocation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71352?
The severity of CVE-2025-71352 is high with a score of 7.6.
How do I fix CVE-2025-71352?
To fix CVE-2025-71352, upgrade to picklescan version 0.0.29 or later.
What does CVE-2025-71352 exploit?
CVE-2025-71352 exploits the failure of picklescan to detect the Python trace.Trace.runctx function in pickle file reduce methods.
What types of attacks can CVE-2025-71352 facilitate?
CVE-2025-71352 can facilitate remote code execution by allowing attackers to execute arbitrary code via crafted pickle files.
Which software is affected by CVE-2025-71352?
The software affected by CVE-2025-71352 is picklescan, specifically versions before 0.0.29.