CVE-2025-71378: picklescan - Remote Code Execution via Undetected cProfile.runctx in Pickle Files
Published Jun 21, 2026
·Updated
picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().
Affected Software
2 affected components
pypi/picklescan<0.0.30
mmaitre314 picklescan<0.0.30
Event History
Jun 21, 2026
CVE Published
via MITRE·01:26 PM
Data Sourced
via MITRE·01:26 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-71378?
The severity of CVE-2025-71378 is rated high with a score of 7.6.
2
How do I fix CVE-2025-71378?
To fix CVE-2025-71378, upgrade picklescan to version 0.0.30 or later.
3
What risks are associated with CVE-2025-71378?
CVE-2025-71378 poses a risk of remote code execution via malicious pickle files that bypass detection.
4
What versions of picklescan are affected by CVE-2025-71378?
All versions of picklescan prior to 0.0.30 are affected by CVE-2025-71378.
5
What capabilities do attackers have with CVE-2025-71378?
Attackers can execute arbitrary code on affected systems by loading malicious pickle files.