Vulnerability Description
picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands, which evade picklescan detection and execute when pickle.load() is called.
Related Weaknesses (CWE)
References
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-v7x6-rv5q-mhwc
- https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-timeit
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-v7x6-rv5q-mhwc
FAQ
What is CVE-2025-71351?
CVE-2025-71351 is a documented vulnerability. picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers can craft pickle files that import dangerou...
How severe is CVE-2025-71351?
CVSS scoring is not yet available for CVE-2025-71351. Check NVD for updates.
Is there a patch for CVE-2025-71351?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.