CVE-2025-71363: picklescan - Arbitrary Code Execution via Undetected cProfile.run in Pickle Deserialization
Published Jun 30, 2026
·Updated
picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with cProfile.run payloads that bypass picklescan detection and achieve code execution upon deserialization.
Affected Software
1 affected component
picklescan<0.0.30
Event History
Jun 30, 2026
CVE Published
via MITRE·10:08 PM
Data Sourced
via MITRE·10:08 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-71363?
CVE-2025-71363 has a high severity rating of 7.6.
2
How do I fix CVE-2025-71363?
To fix CVE-2025-71363, upgrade to picklescan version 0.0.30 or later.
3
What type of vulnerability is CVE-2025-71363?
CVE-2025-71363 is an arbitrary code execution vulnerability that occurs during pickle deserialization.
4
Who is affected by CVE-2025-71363?
Users of picklescan versions prior to 0.0.30 are affected by CVE-2025-71363.
5
What can attackers do with CVE-2025-71363?
Attackers can craft malicious pickle files that exploit the vulnerability to execute arbitrary code on the victim's system.