PT-2026-51763 · Picklescan · Picklescan

Fredericdt · Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2025-71361

Mitre

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch tip calls in pickle files, allowing remote code execution. Attackers can embed undetected payloads in pickle files that execute arbitrary code when loaded via pickle.load().

Correção

Eval Injection

Enumeração de Fraquezas

CWE-95

Identificadores relacionados

CVE-2025-71361

Produtos afetados

Picklescan

Referências · 2

• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-8r4j-24qv-fmq9 · Aviso do Fabricante
• https://vulncheck.com/advisories/picklescan-remote-code-execution-via-undetected-idlelib-calltip-calltip-fetch-tip · Nota