CVE-2025-71355: Picklescan - Arbitrary Code Execution via Unsafe Numpy Function Detection Bypass
Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and execute arbitrary code during deserialization. Attackers can craft malicious pickle files using numpy.testing.private.utils.runstring within the reduce method to import dangerous libraries like os and execute arbitrary OS commands when the pickle file is loaded.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71355?
CVE-2025-71355 has a high severity rating of 7.6 according to the CVSS score.
How do I fix CVE-2025-71355?
To fix CVE-2025-71355, upgrade Picklescan to version 0.0.25 or later.
What does CVE-2025-71355 exploit?
CVE-2025-71355 exploits a vulnerability that allows arbitrary code execution through unsafe Numpy function detection bypass.
Which software is affected by CVE-2025-71355?
CVE-2025-71355 affects the Picklescan software versions prior to 0.0.25.
What are the risks associated with CVE-2025-71355?
The risks associated with CVE-2025-71355 include potentially allowing attackers to execute arbitrary code during the deserialization process.