Arbitrary Code Execution in Picklescan Affected by Remote Exploits

CVE-2025-71364

What is CVE-2025-71364?

Picklescan before version 0.0.30 contains a vulnerability that allows attackers to exploit the 'asyncio.unix_events._UnixSubprocessTransport._start' function in pickle reduce methods. This flaw enables remote code execution through specially crafted pickle files, which can embed this built-in function to bypass detection mechanisms. Consequently, when these malicious files are processed, they can execute arbitrary commands on the host system, posing a significant security risk.

References