CVE-2025-71367: picklescan - Remote Code Execution via _operator.attrgetter Detection Bypass
Published Jul 4, 2026
·Updated
picklescan before 0.0.34 fails to detect operator.attrgetter function calls in pickle payloads, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using operator.attrgetter in reduce methods to execute arbitrary code when pickle.load() processes the file.
Affected Software
1 affected component
picklescan<0.0.34
Event History
Jul 4, 2026
CVE Published
via MITRE·01:23 AM
Data Sourced
via MITRE·01:23 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-71367?
The severity of CVE-2025-71367 is rated as high with a score of 8.1.
2
How do I fix CVE-2025-71367?
To fix CVE-2025-71367, upgrade to picklescan version 0.0.34 or later.
3
What type of vulnerability is CVE-2025-71367?
CVE-2025-71367 is a remote code execution vulnerability.
4
What can attackers do with CVE-2025-71367?
Attackers can craft malicious pickle files to execute arbitrary code during the processing of pickle.load().
5
Who is affected by CVE-2025-71367?
Users of picklescan versions prior to 0.0.34 are affected by CVE-2025-71367.