CVE-2025-71349
picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using trace.Trace.run in the reduce method to achieve arbitrary code execution when pickle.load processes the file.
- Affected products
- Picklescan
- Fix
- Available
- CVSS 3.1
- 8.1 HIGH
- EPSS
- 0.6% (44th percentile)
- Weakness
- CWE-502
- NVD status
- Deferred
- Published
- 2026-06-30
CVE-2025-71349 at NVD
No indexed exploits for CVE-2025-71349 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2025-71349 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.