CVE-2025-71368: picklescan - Arbitrary Code Execution via Undetected doctest.debug_script
Published Jun 30, 2026
·Updated
picklescan before 0.0.30 fails to detect the doctest.debugscript function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files embedding doctest.debugscript calls that bypass picklescan detection and execute arbitrary commands upon pickle.load invocation.
Affected Software
1 affected component
picklescan<0.0.30
Event History
Jun 30, 2026
CVE Published
via MITRE·10:08 PM
Data Sourced
via MITRE·10:08 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeakness
Jan 20, 58467
Event
via NVD·09:53 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-71368?
The severity of CVE-2025-71368 is rated high with a score of 7.6.
2
How do I fix CVE-2025-71368?
To mitigate CVE-2025-71368, upgrade picklescan to version 0.0.30 or later.
3
What type of vulnerability is CVE-2025-71368?
CVE-2025-71368 is an arbitrary code execution vulnerability.
4
Who is affected by CVE-2025-71368?
Users of picklescan versions prior to 0.0.30 are affected by CVE-2025-71368.
5
What can attackers do with CVE-2025-71368?
Attackers can execute arbitrary code by crafting malicious pickle files that exploit the vulnerability.