PT-2026-55681

CVE-2025-71375

Published

2025-12-30

Updated

2026-10-12

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.34

Description The software fails to detect the operator.methodcaller built-in function when scanning pickle files for malicious code. This allows attackers to create malicious pickle payloads using operator.methodcaller that bypass detection and achieve remote code execution when processed by the pickle.load() function.

Recommendations Update to version 0.0.34 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-502: Deserialization of Untrusted Data

Related identifiers