PT-2026-51763 · Picklescan · Picklescan

Fredericdt · Published 2026-06-24 · Updated 2026-06-24 · CVE-2025-71361

NVD

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch tip calls in pickle files, allowing remote code execution. Attackers can embed undetected payloads in pickle files that execute arbitrary code when loaded via pickle.load().

Fix

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2025-71361

Affected Products

Picklescan

References · 3

• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-8r4j-24qv-fmq9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71361 · Security Note
• https://vulncheck.com/advisories/picklescan-remote-code-execution-via-undetected-idlelib-calltip-calltip-fetch-tip · Note