Is CVE-2025-71339 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-71339 being exploited in the wild.

How severe is CVE-2025-71339?

High severity, with a CVSS score of 8.1, published 22 June 2026.

Which products and versions are affected?

picklescan (PyPI) < 0.0.33, ECOSYSTEM:introduced=0,fixed=0.0.33.

Is there a fix for CVE-2025-71339?

Yes. picklescan (PyPI): upgrade to 0.0.33 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-71339 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-71339?

Check whether you run picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-71339: Picklescan arbitrary code execution via NumPy gadget bypass

Q: Which products and versions are affected?

picklescan (PyPI) < 0.0.33, ECOSYSTEM:introduced=0,fixed=0.0.33.

Q: Is there a fix for CVE-2025-71339?

Yes. picklescan (PyPI): upgrade to 0.0.33 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-71339 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-71339?

Check whether you run picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-71339 · Severity: high · CVSS 8.1 · Published 2026-06-22

Picklescan, a tool used to scan Python pickle and PyTorch model files for malicious code, is vulnerable to a bypass that allows arbitrary code execution. An attacker can craft a malicious file that Picklescan incorrectly identifies as safe, but which executes commands when opened by a user. This could lead to full system compromise or supply-chain attacks where malicious AI models are distributed as "verified" safe.

Technologies: picklescan (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-71339 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-71339 being exploited in the wild.
How severe is CVE-2025-71339?: High severity, with a CVSS score of 8.1, published 22 June 2026.
Which products and versions are affected?: picklescan (PyPI) < 0.0.33, ECOSYSTEM:introduced=0,fixed=0.0.33.
Is there a fix for CVE-2025-71339?: Yes. picklescan (PyPI): upgrade to 0.0.33 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-71339 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-71339?: Check whether you run picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

picklescan (PyPI): upgrade to 0.0.33 or later
```
pip install "picklescan>=0.0.33"
```

Technical details

Picklescan fails to detect a malicious pickle gadget utilizing `numpy.f2py.crackfortran._eval_length` within the `__reduce__` method. This function can be used to execute arbitrary Python code when a pickle file is loaded via `pickle.load()`. Because Picklescan's security scanner does not flag this specific function as dangerous, it reports malicious files as safe, enabling remote code execution on systems that rely on Picklescan to vet untrusted artifacts. The vulnerability is addressed in version 0.0.33.

Affected products

mmaitre314 picklescan < 0.0.33

Identifiers

CVE-2025-71339
GHSA-6556-fwc2-fg2p
PYSEC-2026-1783

Timeline

2025-12-27: patched: Version 0.0.33 released
2025-12-30: disclosed: GHSA advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.