Unrated severityNVD Advisory· Published Jul 4, 2026· Updated Jul 6, 2026
picklescan - Unsafe Deserialization via lib2to3.pgen2.grammar.Grammar.loads
CVE-2025-71359
Description
picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce method, allowing remote code execution. Attackers can craft pickle files embedding dangerous code that evades picklescan detection and executes during pickle.load() deserialization.
Patches
Vulnerability mechanics
References
2- github.com/mmaitre314/picklescan/security/advisories/GHSA-f54q-57x4-jg88mitrevendor-advisory
- www.vulncheck.com/advisories/picklescan-unsafe-deserialization-via-lib2to3-pgen2-grammar-grammar-loadsmitrethird-party-advisory
News mentions
0No linked articles in our index yet.