Dashboard / CVE-2025-71357

CVE-2025-71357

HIGH
MEDIUM Priority: 0.03 BB Relevance: 65/100
Published: 2026-06-21 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
AT: Present
VC: High
VI: High
VA: None

Description

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
picklescan picklescan 0 < 0.0.30

References & Advisories (2)

Bug Bounty Relevance

65 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

7.6 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.39%
Raw Score 0.003920
Percentile 33.9%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00392
2026-11-12
0.00392
2026-11-10
0.00392
2026-11-09
0.00392
2026-11-08
0.00392

Intelligence Sources

mitre ref →

External Links