CVE-2025-71373 | picklescan before 0.0.33 fails to detect operator.methodcall… | CVSS 8.1 HIGH

Description

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on picklescan for validation.

Metadata

CVE ID: CVE-2025-71373
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-06-20 13:11 UTC
Published: 2026-07-04 01:23 UTC
Last updated: 2026-07-04 01:23 UTC
Primary CWE: CWE-693
Protection Mechanism Failure
Vendor / Product: picklescan / picklescan
Sources: cve.org · NVD

Severity & Metrics

8.1 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products (1)

Vendor	Product	Platform	Versions
picklescan	picklescan	—	0 < 0.0.33, 0.0.33

Weakness (CWE)

CWE	Source	Description
CWE-693	cna	Protection Mechanism Failure

CVSS scores (2)

Score	Severity	Version	Source	Vector
8.1	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
7.6	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References (2)

GitHub Security Advisory (GHSA-x843-g5mx-g377) https://github.com/mmaitre314/picklescan/security/advisories/GHSA-x843-g5mx-g377
VulnCheck Advisory: picklescan - Remote Code Execution via operator.methodcaller Detection Bypass https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-operator-methodcaller-detection-bypass