PT-2026-54005

CVE-2025-71349

Published

2025-08-26

Updated

2026-10-12

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.29

Description The software fails to detect the built-in trace.Trace.run function during the analysis of pickle files. This allows remote attackers to embed malicious code within the reduce method of a crafted pickle file. When the pickle.load function processes such a file, it can lead to arbitrary code execution.

Recommendations Update to version 0.0.29 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-502: Deserialization of Untrusted Data

Related identifiers

CVE-2025-71349