Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
picklescan told you the .pkl file was safe. It lied. CVE-2025-71378 is a scanner bypass that lets attackers hide code execution in Python pickle files. Here's what to check Today:
Post summary
The tweet announces CVE-2025-71378 as a scanner bypass that allows attackers to conceal code execution in Python pickle files.
CVE-2025-71378 Arbitrary Code Execution in picklescan Before 0.0.30 via cProfile.runctx https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-71378
Post summary
This note announces that CVE‑2025‑71378 allows arbitrary code execution in picklescan versions prior to 0.0.30 via cProfile.runctx, with no PoC, exploit code, patch, or active exploitation mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mmaitre314 | picklescan | - | - | - |