CVE-2025-71378: picklescan remote code execution bypass via cProfile.runctx

CVE-2025-71378 · Severity: high · CVSS 8.1 · Published 2026-06-21

Picklescan is a widely-used library that organizations rely on to scan pickle files (a Python serialization format) for malicious code before loading them into machine learning models and data processing pipelines. This vulnerability allows attackers to bypass Picklescan's safety checks by exploiting a detection gap: the library fails to flag dangerous code hidden within calls to Python's built-in cProfile.runctx function. An attacker distributing infected pickle files through model repositories or APIs could execute arbitrary commands on systems that trust Picklescan to validate the files, potentially compromising sensitive data, disrupting operations, or establishing persistent access.

Technologies: picklescan (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-71378 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-71378 being exploited in the wild.
How severe is CVE-2025-71378?
High severity, with a CVSS score of 8.1, published 21 June 2026.
Which products and versions are affected?
picklescan (PyPI) < 0.0.30, ECOSYSTEM:introduced=0,fixed=0.0.30.
Is there a fix for CVE-2025-71378?
Yes. picklescan (PyPI): upgrade to 0.0.30 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-71378 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-71378?
Check whether you run picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • picklescan (PyPI): upgrade to 0.0.30 or later
    pip install "picklescan>=0.0.30"

Technical details

The vulnerability is a deserialization bypass (CWE-502) in Picklescan's detection logic. An attacker crafts a malicious pickle file using the __reduce__ method to return cProfile.runctx as a callable with a command string argument. While cProfile.runctx is a legitimate Python standard library function designed for performance profiling, it ultimately executes arbitrary Python code via exec(), making it a gadget for remote code execution. Picklescan versions prior to 0.0.30 do not flag cProfile.runctx in their dangerous-function detection lists, so the malicious pickle file passes validation. When a user calls pickle.load() on the file after clearance from Picklescan, the __reduce__ method triggers, invoking cProfile.runctx with the attacker's payload, resulting in code execution. The attack requires only that the victim use pickle.load() on an untrusted file after scanning it with vulnerable Picklescan versions; no authentication or additional user interaction is required. The fix in version 0.0.30 adds cProfile.runctx to the detection blocklist.

Affected products

  • mmaitre314 picklescan < 0.0.30

Identifiers

  • CVE-2025-71378
  • GHSA-9w88-8rmg-7g2p
  • PYSEC-2026-247

Timeline

  • 2025-08-26: disclosed: GitHub advisory GHSA-9w88-8rmg-7g2p published
  • 2025-08-26: patched: Picklescan version 0.0.30 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.