CVE-2025-71320

CriticalCVSS 9.8/10Last modified Oct 12, 2026

Description

picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when the pickle is deserialized.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-184

Affected software

No affected versions have been published.

Timeline

Published: Jun 17, 2026
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-713219.8picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using d CVE-2025-713228.8PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. M CVE-2025-713239.8picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls a CVE-2025-713247.5Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai CVE-2025-713259.8picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track a CVE-2025-713267.8AVAST Antivirus 25.11 contains an unquoted service path vulnerability in the SecureLine service that allows local non-privileged users to ex CVE-2025-713279.1Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated att CVE-2025-713288.8Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through CVE-2025-713297.5image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop CVE-2025-71335.4A vulnerability classified as problematic has been found in CodeAstro Online Movie Ticket Booking System 1.0. This affects an unknown part. CVE-2025-713307.5image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop CVE-2025-713316.1Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom