CVE-2025-71363

Received Received - Intake

Code Execution via Undetected cProfile.run in Picklescan

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with cProfile.run payloads that bypass picklescan detection and achieve code execution upon deserialization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2025-71363

EUVD

EUVD-2025-210389

Affected Vendors & Products

Vendor	Product	Version / Range
picklescan	picklescan	to 0.0.30 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability exists in picklescan versions before 0.0.30, where the software fails to detect the use of the cProfile.run function within pickle reduce methods.

Because of this failure, attackers can craft malicious pickle files containing cProfile.run payloads that bypass picklescan's detection mechanisms.

When these malicious pickle files are deserialized, they allow remote attackers to execute arbitrary code on the affected system.

Impact Analysis

This vulnerability can have a significant impact as it allows remote attackers to execute arbitrary code on your system without requiring privileges or user interaction beyond deserialization.

Successful exploitation could lead to compromise of confidentiality and integrity of your system, as indicated by the high CVSS scores.

Attackers could potentially run malicious commands or software, leading to unauthorized access or manipulation of data.

Hi! I’m here to help you understand CVE-2025-71363. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70