CVE-2025-71373 | BDVDB-2026-345552 Detail

Description#

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on picklescan for validation.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-04Record published in the CVE List.
2. Version 22026-07-06Most recent update recorded in the CVE List.