CVE-2025-71359: picklescan - Unsafe Deserialization via lib2to3.pgen2.grammar.Grammar.loads
Published Jul 4, 2026
·Updated
picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce method, allowing remote code execution. Attackers can craft pickle files embedding dangerous code that evades picklescan detection and executes during pickle.load() deserialization.
Affected Software
1 affected component
picklescan<0.0.29
Event History
Jul 4, 2026
CVE Published
via MITRE·01:23 AM
Data Sourced
via MITRE·01:23 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-71359?
CVE-2025-71359 has a high severity rating of 8.1.
2
How do I fix CVE-2025-71359?
To fix CVE-2025-71359, update picklescan to version 0.0.29 or later.
3
What type of vulnerability is CVE-2025-71359?
CVE-2025-71359 is an unsafe deserialization vulnerability that can lead to remote code execution.
4
What software is affected by CVE-2025-71359?
The affected software by CVE-2025-71359 is picklescan before version 0.0.29.
5
What can an attacker achieve through CVE-2025-71359?
An attacker can execute arbitrary code on the system using malicious pickle files due to CVE-2025-71359.