PT-2026-50455 · Picklescan · Picklescan

Lyutoon · Published 2026-06-17 · Updated 2026-06-17 · CVE-2025-71325

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

picklescan before 0.0.27 contains a parsing logic error in the list globals function when handling STACK GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files with arguments at position zero to trigger unexpected exceptions and evade security scanning.

Exploit

Fix

Weakness Enumeration

CWE-391

Related Identifiers

CVE-2025-71325

Affected Products

Picklescan

References · 3

• 🔥 https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9gvj-pp9x-gcfr · Exploit
• https://github.com/mmaitre314/picklescan/commit/2a8383cfeb4158567f9770d86597300c9e508d0f · Patch
• https://vulncheck.com/advisories/picklescan-detection-bypass-via-stack-global-opcode-parsing-logic-flaw · Note