CVE-2025-71357: picklescan - Arbitrary Code Execution via Undetected idlelib.pyshell.ModifiedInterpreter.runcommand
Published Jun 21, 2026
·Updated
picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.
Affected Software
2 affected components
pypi/picklescan<0.0.30
mmaitre314 picklescan<0.0.30
Event History
Jun 21, 2026
CVE Published
via MITRE·01:26 PM
Data Sourced
via MITRE·01:26 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-71357?
The severity of CVE-2025-71357 is classified as high with a score of 7.6.
2
How does CVE-2025-71357 affect picklescan?
CVE-2025-71357 allows attackers to execute arbitrary code through malicious pickle files that are not properly detected.
3
What versions of picklescan are impacted by CVE-2025-71357?
Picklescan versions before 0.0.30 are vulnerable to CVE-2025-71357.
4
How do I fix CVE-2025-71357?
To mitigate CVE-2025-71357, upgrade to picklescan version 0.0.30 or later.
5
What type of attack is enabled by CVE-2025-71357?
CVE-2025-71357 enables remote command execution attacks via undetected malicious code in pickle files.