High severityNVD Advisory· Published Jun 30, 2026· Updated Oct 12, 2026

CVE-2025-71355

Description

Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and execute arbitrary code during deserialization. Attackers can craft malicious pickle files using numpy.testing._private.utils.runstring within the reduce method to import dangerous libraries like os and execute arbitrary OS commands when the pickle file is loaded.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

mmaitre314/picklescanllm-fuzzy
Range: <0.0.25

Patches

Vulnerability mechanics

References

github.com/mmaitre314/picklescan/security/advisories/GHSA-fj43-3qmq-673fnvd
www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-unsafe-numpy-function-detection-bypassnvd

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000