Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2025-71355Picklescan - Arbitrary Code Execution via Unsafe Numpy Function Detection Bypass

High 7.6

In plain English

A high-severity security flaw in Picklescan from Picklescan. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.6High

Exploit odds (30 days)0.6%top 49.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and execute arbitrary code during deserialization. Attackers can craft malicious pickle files using numpy.testing._private.utils.runstring within the reduce method to import dangerous libraries like os and execute arbitrary OS commands when the pickle file is loaded.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	picklescan	0.0.25	GHSA-fj43-3qmq-673f

Affected products (as reported)

Vendor	Product	Versions
Picklescan	Picklescan	0 – before 0.0.25

Weakness: CWE-184 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-fj43-3qmq-673f) vendor-advisory
VulnCheck Advisory: Picklescan - Arbitrary Code Execution via Unsafe Numpy Function Detection Bypass third-party-advisory