CVE-2025-71358: picklescan - Remote Code Execution via idlelib.autocomplete.AutoComplete.get_entity
Published Jun 22, 2026
·Updated
picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.getentity function in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims using pickle.load().
Affected Software
1 affected component
pypi/picklescan<0.0.29
Event History
Jun 22, 2026
CVE Published
via MITRE·09:04 PM
Data Sourced
via MITRE·09:04 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 PM
DescriptionSeverityWeakness
Oct 27, 58444
Event
via NVD·08:58 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-71358?
The severity of CVE-2025-71358 is rated high with a score of 7.6.
2
How do I fix CVE-2025-71358?
To fix CVE-2025-71358, upgrade to picklescan version 0.0.29 or later, which addresses the vulnerability.
3
What type of attack does CVE-2025-71358 enable?
CVE-2025-71358 enables remote code execution by allowing attackers to embed malicious code in pickle files.
4
What software is affected by CVE-2025-71358?
CVE-2025-71358 affects picklescan versions prior to 0.0.29.
5
What is the impact of exploiting CVE-2025-71358?
Exploiting CVE-2025-71358 can lead to arbitrary command execution on a victim's machine when a malicious pickle file is loaded.