CVE-2025-71364

HighCVSS 8.1/10Last modified Oct 12, 2026

Description

picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickle reduce methods, allowing remote code execution. Attackers can craft malicious pickle files embedding this built-in function that evade detection but execute arbitrary commands when loaded.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Jul 4, 2026
Last modified
Oct 12, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-713658.1picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce methoCVE-2025-713668.1picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile function calls in pickle files, allowing attCVE-2025-713678.1picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, allowing attackers to bypass security checkCVE-2025-713688.1picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing attackers to execute arbitrCVE-2025-713698.1picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.utils.decoder.basichandlers in reduce meCVE-2025-71378.8A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been classified as critical. This affects an unknown paCVE-2025-713708.1picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle files. AttCVE-2025-713718.1picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can cCVE-2025-713728.1Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, allowing arbitrary codeCVE-2025-713738.1picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks.CVE-2025-713748.1picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attacCVE-2025-713758.1picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning pickle files for malicious code. Attacke
CVE-2025-71364: High severity, CVSS 8.1 | Vulnix