CVE-2025-71351

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-71351

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71351.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-71351

Aliases

GHSA-v7x6-rv5q-mhwc

Published

2026-06-21T13:26:48.720Z

Modified

2026-07-15T01:48:56.208933086Z

Severity

7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

picklescan - Remote Code Execution via timeit.timeit() Detection Bypass

Details

picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the reduce method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands, which evade picklescan detection and execute when pickle.load() is called.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71351.json",
    "cwe_ids": [
        "CWE-184"
    ],
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/mmaitre314/picklescan

Affected ranges

Type

GIT

Repo

https://github.com/mmaitre314/picklescan

Events

Introduced

Fixed

62e76cfdf9aaaa3d0a26b78f7a93710406482274

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.0.25"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*

v0.0.10

v0.0.11

v0.0.12

v0.0.13

v0.0.14

v0.0.15

v0.0.17

v0.0.18

v0.0.19

v0.0.2

v0.0.20

v0.0.21

v0.0.22

v0.0.23

v0.0.24

v0.0.3

v0.0.4

v0.0.5

v0.0.6

v0.0.7

v0.0.8

v0.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71351.json"