PT-2026-55676 · Picklescan · Picklescan

Fredericdt · Published 2026-07-04 · Updated 2026-07-04 · CVE-2025-71366

NVD

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck. main .run cprofile function calls in pickle files, allowing attackers to bypass safety checks. Remote attackers can embed undetected code in pickle files to achieve arbitrary code execution when victims load the files.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-71366

Affected Products

Picklescan

References · 3

• https://github.com/mmaitre314/picklescan/security/advisories/GHSA-4r9r-ch6f-vxmx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71366 · Security Note
• https://vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-torch-utils-bottleneck-main-run-cprofile · Note