CVE-2025-71320

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.33

Description An incomplete deny-list fails to block the pydoc.locate() and operator.methodcaller() functions. This allows remote attackers to bypass security checks by crafting malicious pickle files. The pydoc.locate() function can dynamically resolve and import arbitrary modules, while operator.methodcaller() enables the execution of a method on an object. When combined, these functions can be used to achieve arbitrary code execution during the deserialization of the pickle file.

Recommendations Update to version 0.0.33 or later.