CVE-2025-71366

picklescan - Arbitrary Code Execution via torch.utils.bottleneck.main.run_cprofile

CVSS 7.6 HIGHCWE-502

Vexday Risk Score

18Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.6EPSS —KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

04 Jul 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile function calls in pickle files, allowing attackers to bypass safety checks. Remote attackers can embed undetected code in pickle files to achieve arbitrary code execution when victims load the files.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected products

picklescan · picklescan

References

https://github.com/mmaitre314/picklescan/security/advisories/GHSA-4r9r-ch6f-vxmx https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-torch-utils-bottleneck-main-run-cprofile

picklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_cprofile

picklescan - Arbitrary Code Execution via torch.utils.bottleneck.main.run_cprofile