High severity8.1NVD Advisory· Published Jul 4, 2026· Updated Jul 7, 2026

CVE-2025-71375

Description

picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning pickle files for malicious code. Attackers can craft malicious pickle payloads using _operator.methodcaller that evade detection and execute arbitrary code when loaded by pickle.load().

Affected products

mmaitre314/picklescanllm-fuzzy
Range: <0.0.34

Patches

Vulnerability mechanics

References

github.com/mmaitre314/picklescan/security/advisories/GHSA-955r-x9j8-7rhhnvd
www.vulncheck.com/advisories/picklescan-undetected-remote-code-execution-via-operator-methodcallernvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000