PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-71341 picklescan CVE debrief

CVE-2025-71341 is a high-severity vulnerability in the picklescan library before version 0.0.29. The library fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to achieve remote code execution when the pickle file is loaded. This vulnerability has a CVSS score of 7.6 and is considered HIGH severity. The CVE was published on June 23, 2026, and last modified on June 23, 2026.

Vendor
picklescan
Product
Unknown
CVSS
HIGH 7.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-23
Original CVE updated
2026-06-23
Advisory published
2026-06-23
Advisory updated
2026-06-23

Who should care

Developers and users of the picklescan library, especially those using versions before 0.0.29, should be aware of this vulnerability. This vulnerability can allow remote attackers to execute arbitrary code, potentially leading to system compromise. Users of applications that utilize picklescan for pickle file analysis are also advised to take precautions.

Technical summary

The picklescan library, used for analyzing pickle files, has a vulnerability that allows remote code execution. The library fails to detect the profile.Profile.runctx function, which can be used by attackers to embed malicious code in pickle files. When these malicious files are loaded, the embedded code can be executed, leading to potential system compromise. The vulnerability is due to the incomplete detection of profile.Profile.runctx in the reduce method. This issue affects picklescan versions before 0.0.29.

Defensive priority

High priority should be given to updating the picklescan library to version 0.0.29 or later. In the meantime, users should exercise caution when loading pickle files from untrusted sources.

Recommended defensive actions

  • Update picklescan to version 0.0.29 or later.
  • Implement input validation and sanitization for pickle files.
  • Use secure methods for loading pickle files.
  • Monitor systems for suspicious activity related to pickle file loading.
  • Consider using alternative libraries for pickle file analysis.

Evidence notes

The CVE-2025-71341 vulnerability was published on June 23, 2026, and last modified on June 23, 2026. The vulnerability has a CVSS score of 7.6 and is considered HIGH severity. The vulnerability is caused by the picklescan library's failure to detect the profile.Profile.runctx function when analyzing pickle files.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-71341 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-71341

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-71341 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-71341

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.