PT-2026-54010 · Picklescan · Picklescan

Fredericdt · Published 2026-06-30 · Updated 2026-06-30 · CVE-2025-71368

Mitre

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

picklescan before 0.0.30 fails to detect the doctest.debug script function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files embedding doctest.debug script calls that bypass picklescan detection and execute arbitrary commands upon pickle.load invocation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-71368

Affected Products

Picklescan

References · 3

• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-fqq6-7vqf-w3fg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71368 · Security Note
• https://vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-undetected-doctest-debug-script · Note