CVE-2025-71375: picklescan - Undetected Remote Code Execution via _operator.methodcaller

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-04 · updated 2026-10-12
Weakness: CWE-502

Description

picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning pickle files for malicious code. Attackers can craft malicious pickle payloads using _operator.methodcaller that evade detection and execute arbitrary code when loaded by pickle.load().

Affected products

picklescan: before 0.0.34 — fixed in 0.0.34

How to fix

Upgrade to a fixed version: picklescan 0.0.34. Check the vendor advisory for mitigations.

References

https://github.com/mmaitre314/picklescan/security/advisories/GHSA-955r-x9j8-7rhh
https://www.vulncheck.com/advisories/picklescan-undetected-remote-code-execution-via-operator-methodcaller
https://github.com/mmaitre314/picklescan/security/advisories/GHSA-955r-x9j8-7rhh

Get alerted when CVE-2025-71375 or the next vulnerability affects your stack