Unrated severityNVD Advisory· Published Jun 21, 2026

picklescan - Arbitrary Code Execution via Undetected idlelib.pyshell.ModifiedInterpreter.runcommand

CVE-2025-71357

Description

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pypi/Picklescaninferred
Range: <0.0.30
Package: https://pypi.org/project/picklescan
mmaitre314/picklescanllm-fuzzy
Range: <0.0.30

Patches

Vulnerability mechanics

References

github.com/mmaitre314/picklescan/security/advisories/GHSA-j343-8v2j-ff7wmitrevendor-advisory
www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-undetected-idlelib-pyshell-modifiedinterpreter-runcommandmitrethird-party-advisory

News mentions

Picklescan: Nine RCE Vulnerabilities Disclosed Together via Detection Bypasses
Vypr Intelligence · Jun 23, 2026

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000