CVE-2025-71373: picklescan - Remote Code Execution via operator.methodcaller Detection Bypass
Published Jul 4, 2026
·Updated
picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on picklescan for validation.
Affected Software
1 affected component
picklescan<0.0.33
Event History
Jul 4, 2026
CVE Published
via MITRE·01:23 AM
Data Sourced
via MITRE·01:23 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-71373?
The severity of CVE-2025-71373 is high with a score of 8.1.
2
How do I fix CVE-2025-71373?
To fix CVE-2025-71373, upgrade picklescan to version 0.0.33 or later.
3
What does CVE-2025-71373 exploit?
CVE-2025-71373 exploits a failure to detect operator.methodcaller function calls in pickle files.
4
What are the potential impacts of CVE-2025-71373?
CVE-2025-71373 allows remote attackers to execute arbitrary code on systems that use vulnerable versions of picklescan.
5
What versions of picklescan are affected by CVE-2025-71373?
All versions of picklescan prior to 0.0.33 are affected by CVE-2025-71373.