CVE-2025-71363

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-71363

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71363.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-71363

Aliases

GHSA-49gj-c84q-6qm9

Published

2026-06-30T22:08:18.794Z

Modified

2026-07-15T01:49:01.154050732Z

Severity

7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

picklescan - Arbitrary Code Execution via Undetected cProfile.run in Pickle Deserialization

Details

picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with cProfile.run payloads that bypass picklescan detection and achieve code execution upon deserialization.

Database specific

{
    "cwe_ids": [
        "CWE-502"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71363.json",
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/mmaitre314/picklescan

Affected ranges

Type

GIT

Repo

https://github.com/mmaitre314/picklescan

Events

Introduced

Fixed

1931c2d04eaca8d20597705ff39cab78ba364e4b

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.0.30"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*

v0.0.10

v0.0.11

v0.0.12

v0.0.13

v0.0.14

v0.0.15

v0.0.17

v0.0.18

v0.0.19

v0.0.2

v0.0.20

v0.0.21

v0.0.22

v0.0.23

v0.0.24

v0.0.25

v0.0.26

v0.0.27

v0.0.28

v0.0.29

v0.0.3

v0.0.4

v0.0.5

v0.0.6

v0.0.7

v0.0.8

v0.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71363.json"