CVE-2025-71373EPSS p36.9%

CVE-2025-71373CVE-2025-71373

Description

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on picklescan for validation.

Scoring

CVSS 8.1 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS0.44% probability of exploitation · percentile 36.9% · 2026-08-17T12:03:47Z
Last modified2026-07-06
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.