CVE-2025-71360 HIGH

CVE-2025-71360: picklescan - Remote Code Execution via Undetected idlelib.calltip.get_entity

Vendor Picklescan

Product picklescan

Weakness CWE-502 · Unsafe deserialization

Published July 4, 2026

Last update July 4, 2026

View on NVD All CVEs

CVSS base score

7.6/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

Key dates

02Disclosure timeline

July 4, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-71360 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html

Related vulnerabilities

04Related CVE

CVE-2026-57621 WordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerability CVE-2026-14265 RCE via Deserialization in AWS Advanced JDBC Wrapper CVE-2025-71356 picklescan - Arbitrary Code Execution via torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression CVE-2025-71353 picklescan - Remote Code Execution via torch._dynamo.guards.GuardBuilder.get CVE-2026-12240 Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field