CVE-2025-71340

picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects. This is fixed in version 0.0.30.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mmaitre314/picklescan/security/advisories/GHSA-3gf5-cxq9-w223
https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-idlelib-pyshell-modifiedinterpreter-runcode
https://github.com/mmaitre314/picklescan/security/advisories/GHSA-3gf5-cxq9-w223

Configurations

No configuration.

History

30 Sep 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) picklescan hasta la versión 0.0.26 falla en detectar archivos pickle maliciosos que invocan idlelib.pyshell.ModifiedInterpreter.runcode en métodos __reduce__. Los atacantes pueden incrustar código no detectado en archivos pickle que ejecuta comandos arbitrarios cuando el archivo es cargado a través de pickle.load(), lo que permite ataques a la cadena de suministro en modelos de PyTorch y objetos Python guardados. Esto está corregido en la versión 0.0.30.

Information

Published : 2026-06-25 22:16

Updated : 2026-10-12 21:10

NVD link : CVE-2025-71340

Mitre link : CVE-2025-71340

CVE.ORG link : CVE-2025-71340

JSON object : View

Products Affected

No product.

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2025-71340", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71340", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-26T13:40:42.281053Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "picklescan", "product": "picklescan", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.0.26"}, {"status": "unaffected", "version": "0.0.30", "versionType": "semver"}], "packageURL": "pkg:pypi/picklescan", "defaultStatus": "unaffected"}]}], "published": "2026-06-25T22:16:59.647", "references": [{"url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-3gf5-cxq9-w223", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-idlelib-pyshell-modifiedinterpreter-runcode", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-3gf5-cxq9-w223", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects. This is fixed in version 0.0.30."}, {"lang": "es", "value": "picklescan hasta la versi\u00f3n 0.0.26 falla en detectar archivos pickle maliciosos que invocan idlelib.pyshell.ModifiedInterpreter.runcode en m\u00e9todos __reduce__. Los atacantes pueden incrustar c\u00f3digo no detectado en archivos pickle que ejecuta comandos arbitrarios cuando el archivo es cargado a trav\u00e9s de pickle.load(), lo que permite ataques a la cadena de suministro en modelos de PyTorch y objetos Python guardados. Esto est\u00e1 corregido en la versi\u00f3n 0.0.30."}], "lastModified": "2026-10-12T21:10:00.227", "sourceIdentifier": "disclosure@vulncheck.com"}