CVE-2025-71354: picklescan - Remote Code Execution via idlelib.debugobj.ObjectTreeItem.SetText
Published Jun 24, 2026
·Updated
picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can craft pickle files with embedded code that bypasses picklescan detection and executes arbitrary commands when pickle.load() is called.
Affected Software
1 affected component
pypi/picklescan<0.0.29
Event History
Jun 24, 2026
CVE Published
via MITRE·11:53 AM
Data Sourced
via MITRE·11:53 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-71354?
The severity of CVE-2025-71354 is rated as high with a score of 8.1.
2
How do I fix CVE-2025-71354?
To fix CVE-2025-71354, upgrade to picklescan version 0.0.29 or later.
3
What does CVE-2025-71354 exploit?
CVE-2025-71354 exploits the idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods of the picklescan software.
4
What kind of attack can be performed using CVE-2025-71354?
CVE-2025-71354 enables attackers to perform remote code execution through malicious pickle files.
5
Which versions of picklescan are affected by CVE-2025-71354?
Versions of picklescan prior to 0.0.29 are affected by CVE-2025-71354.