CVE-2025-71374: picklescan - Arbitrary Code Execution via Undetected profile.Profile.run
Published Jun 30, 2026
·Updated
picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files that bypass picklescan detection and achieve code execution upon deserialization.
Affected Software
1 affected component
picklescan<0.0.29
Event History
Jun 30, 2026
CVE Published
via MITRE·10:08 PM
Data Sourced
via MITRE·10:08 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeakness
Jan 20, 58467
Event
via NVD·12:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-71374?
CVE-2025-71374 has a severity rating of 7.6, classified as high.
2
What is the impact of CVE-2025-71374?
CVE-2025-71374 allows remote attackers to execute arbitrary code due to undetected use of the profile.Profile.run function.
3
How do I fix CVE-2025-71374?
To fix CVE-2025-71374, upgrade picklescan to version 0.0.29 or later, where the vulnerability is addressed.
4
Who is affected by CVE-2025-71374?
Users of picklescan versions prior to 0.0.29 are affected by CVE-2025-71374.
5
What type of vulnerability is CVE-2025-71374?
CVE-2025-71374 is classified as an arbitrary code execution vulnerability.