CVE-2025-71355

Name of the Vulnerable Software and Affected Versions Picklescan versions prior to 0.0.25

Description Picklescan fails to detect unsafe global functions within the Numpy library, which allows attackers to bypass static analysis. This issue enables the execution of arbitrary code during deserialization. An attacker can create malicious pickle files using the numpy.testing. private.utils.runstring function within the reduce method to import dangerous libraries, such as os, and execute arbitrary operating system commands when the file is loaded.

Recommendations Update Picklescan to version 0.0.25 or later.