High severity8.1NVD Advisory· Published Jul 4, 2026· Updated Jul 6, 2026

CVE-2025-71359

Description

picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce method, allowing remote code execution. Attackers can craft pickle files embedding dangerous code that evades picklescan detection and executes during pickle.load() deserialization.

Affected products

mmaitre314/picklescanllm-fuzzy
Range: <0.0.29

Patches

Vulnerability mechanics

References

github.com/mmaitre314/picklescan/security/advisories/GHSA-f54q-57x4-jg88nvd
www.vulncheck.com/advisories/picklescan-unsafe-deserialization-via-lib2to3-pgen2-grammar-grammar-loadsnvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000