CVE-2025-71364: picklescan - Arbitrary Code Execution via Undetected asyncio.unix_events._UnixSubprocessTransport._start
Published Jul 4, 2026
·Updated
picklescan before 0.0.30 fails to detect the asyncio.unixevents.UnixSubprocessTransport.start function in pickle reduce methods, allowing remote code execution. Attackers can craft malicious pickle files embedding this built-in function that evade detection but execute arbitrary commands when loaded.
Affected Software
1 affected component
picklescan<0.0.30
Event History
Jul 4, 2026
CVE Published
via MITRE·01:23 AM
Data Sourced
via MITRE·01:23 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-71364?
CVE-2025-71364 has a severity rating of 8.1, indicating a high risk.
2
How do I fix CVE-2025-71364?
To mitigate CVE-2025-71364, upgrade picklescan to version 0.0.30 or later.
3
What kind of vulnerability is CVE-2025-71364?
CVE-2025-71364 is an arbitrary code execution vulnerability.
4
What software is affected by CVE-2025-71364?
CVE-2025-71364 affects picklescan versions prior to 0.0.30.
5
How can attackers exploit CVE-2025-71364?
Attackers can exploit CVE-2025-71364 by using malicious pickle files that leverage undetected functionality to execute arbitrary commands.