Remote Code Execution Vulnerability in Picklescan Software by Maitre314
CVE-2025-71320

9.3CRITICAL

Key Information:

Vendor

Picklescan

Status
Picklescan
Vendor
CVE Published:
17 June 2026

What is CVE-2025-71320?

Picklescan versions before 0.0.33 exhibit a vulnerability due to an incomplete deny-list. This flaw allows remote attackers to bypass critical security checks by utilizing the pydoc.locate and operator.methodcaller functions. By crafting malicious pickle files, an attacker can exploit this vulnerability when the pickle is deserialized, potentially leading to arbitrary code execution on the affected system.

Affected Version(s)

picklescan 0 < 0.0.33

picklescan 0.0.33

References

https://github.com/mmaitre314/picklescan/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/picklescan-remote-co...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

0x-Apollyon
.