CVE-2025-71367 | BDVDB-2026-345549 Detail

Description#

picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using _operator.attrgetter in reduce methods to execute arbitrary code when pickle.load() processes the file.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-04Record published in the CVE List.
2. Version 22026-07-06Most recent update recorded in the CVE List.