High severity8.1NVD Advisory· Published Jun 21, 2026· Updated Jun 26, 2026

CVE-2025-71357

Description

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

mmaitre314/picklescan2 versions
cpe:2.3:a:mmaitre314:picklescan:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mmaitre314:picklescan:*:*:*:*:*:*:*:*range: <0.0.30
- (no CPE)range: <0.0.30
Pypi/Picklescaninferred
Range: <0.0.30
Package: https://pypi.org/project/picklescan

Patches

Vulnerability mechanics

References

github.com/mmaitre314/picklescan/security/advisories/GHSA-j343-8v2j-ff7wnvdExploitVendor Advisory
github.com/advisories/GHSA-j343-8v2j-ff7wghsaADVISORY
www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-undetected-idlelib-pyshell-modifiedinterpreter-runcommandnvdThird Party Advisory
github.com/mmaitre314/picklescan/commit/1931c2d04eaca8d20597705ff39cab78ba364e4bghsa
github.com/pypa/advisory-database/tree/main/vulns/picklescan/PYSEC-2026-246.yamlghsa

News mentions

Picklescan: Nine RCE Vulnerabilities Disclosed Together via Detection Bypasses
Vypr Intelligence · Jun 23, 2026

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000