CVE-2025-71357: picklescan detection bypass via idlelib runcommand

CVE-2025-71357 · Severity: high · CVSS 8.1 · Published 2026-06-21

Picklescan is a Python library used to scan pickle files for malicious code before loading them—a critical safeguard in machine learning workflows that use serialized models. An attacker can embed code that bypasses Picklescan's detection by using Python's built-in idlelib.pyshell.ModifiedInterpreter.runcommand function, allowing remote code execution when the pickle is loaded. This vulnerability threatens supply chain security in ML model distribution and data serialization.

Technologies: picklescan (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-71357 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-71357 being exploited in the wild.
How severe is CVE-2025-71357?
High severity, with a CVSS score of 8.1, published 21 June 2026.
Which products and versions are affected?
picklescan (PyPI) < 0.0.30, ECOSYSTEM:introduced=0,fixed=0.0.30.
Is there a fix for CVE-2025-71357?
Yes. picklescan (PyPI): upgrade to 0.0.30 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-71357 attacked?
It is attacked over the network.
Am I affected by CVE-2025-71357?
Check whether you run picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • picklescan (PyPI): upgrade to 0.0.30 or later
    pip install "picklescan>=0.0.30"

Technical details

This is a deserialization vulnerability (CWE-502) in which Picklescan fails to detect a specific unsafe callable used in a pickle's __reduce__ method. The attack leverages idlelib.pyshell.ModifiedInterpreter.runcommand—a standard Python library function—to execute arbitrary code passed as a string argument. When a victim loads a malicious pickle after scanning it with Picklescan, the __reduce__ method is invoked during unpickling, calling ModifiedInterpreter.runcommand with attacker-controlled payload. The vulnerable versions (before 0.0.30) do not blacklist or detect this particular code execution path. The attack requires no authentication or special privileges; the victim only needs to call pickle.load() after checking the file with the vulnerable Picklescan library. Patch available in version 0.0.30.

Affected products

  • mmaitre314 picklescan < 0.0.30

Identifiers

  • CVE-2025-71357
  • GHSA-j343-8v2j-ff7w
  • PYSEC-2026-246

Timeline

  • 2025-08-26: disclosed: Vulnerability published as GHSA-j343-8v2j-ff7w
  • 2025-08-26: patched: Fix released in version 0.0.30

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.