CVE-2025-71351: picklescan detection bypass via timeit.timeit leading to RCE

CVE-2025-71351 · Severity: medium · CVSS 4 · Published 2026-06-21

Picklescan is a Python security library designed to scan pickle files for malicious code before they are loaded into applications. This vulnerability allows attackers to bypass Picklescan's detection by using the timeit.timeit() function to execute arbitrary system commands during pickle deserialization. Organizations using Picklescan to validate machine learning models, saved Python objects, or APIs could unknowingly load compromised files that execute attacker-controlled code, enabling data theft, system compromise, or supply chain attacks.

Technologies: picklescan (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-71351 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-71351 being exploited in the wild.
How severe is CVE-2025-71351?
Medium severity, with a CVSS score of 4, published 21 June 2026.
Which products and versions are affected?
picklescan (PyPI) < 0.0.25, ECOSYSTEM:introduced=0,fixed=0.0.25.
Is there a fix for CVE-2025-71351?
Yes. picklescan (PyPI): upgrade to 0.0.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-71351 attacked?
It is attacked over the network.
Am I affected by CVE-2025-71351?
Check whether you run picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • picklescan (PyPI): upgrade to 0.0.25 or later
    pip install "picklescan>=0.0.25"

Technical details

This is an incomplete blacklist vulnerability (CWE-184) in Picklescan's unsafe globals detection. Picklescan uses a blacklist of dangerous functions to detect malicious pickle payloads during deserialization via the reduce protocol. The vulnerability exploits the fact that timeit.timeit() is a built-in Python library function not present in the blacklist. An attacker crafts a pickle file with a __reduce__ method that calls timeit.timeit() with a malicious code string as an argument. When the victim scans the file with Picklescan, it reports no dangerous globals detected. Upon calling pickle.load() on the file, timeit.timeit() executes the attacker's code string, which can import os and call os.system() to run arbitrary OS commands. No authentication or user interaction beyond loading the pickle is required; the attack is triggered purely by unpickling. Picklescan 0.0.25 and later patches this by adding timeit to the unsafe globals blacklist.

Affected products

  • mmaitre314 picklescan < 0.0.25

Identifiers

  • CVE-2025-71351
  • GHSA-v7x6-rv5q-mhwc
  • PYSEC-2026-4135

Timeline

  • 2025-04-07: disclosed
  • 2025-04-07: patched: Picklescan 0.0.25 released with timeit added to unsafe globals blacklist

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.