CVE-2025-71376: picklescan - Arbitrary Code Execution via Undetected idlelib.autocomplete.AutoComplete.fetch_completions
Published Jun 23, 2026
·Updated
picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetchcompletions in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims.
Affected Software
1 affected component
pypi/picklescan<0.0.29
Event History
Jun 23, 2026
CVE Published
via MITRE·12:12 PM
Data Sourced
via MITRE·12:12 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-71376?
The severity of CVE-2025-71376 is high, rated at 8.1.
2
How do I fix CVE-2025-71376?
To fix CVE-2025-71376, upgrade picklescan to version 0.0.29 or later.
3
What type of vulnerability is CVE-2025-71376?
CVE-2025-71376 is an arbitrary code execution vulnerability.
4
What software is affected by CVE-2025-71376?
CVE-2025-71376 affects picklescan versions prior to 0.0.29.
5
What can attackers do with CVE-2025-71376?
Attackers can embed malicious code in pickle files that execute arbitrary commands when loaded.