Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
UnratedPublic exploit

Remote Code Execution via Picklescan Detection Bypass

IdentifiersCVE-2025-71361CWE-184

CVE-2025-71361 is a remote code execution vulnerability affecting picklescan before version 0.0.29. The flaw is a detection bypass in which picklescan fails to identify malicious pickle payloads that invoke idlelib.calltip.Calltip.fetch_tip. As a result, an attacker can craft a pickle file that appears to pass scanning but still contains executable malicious behavior. If that pickle file is subsequently deserialized with Python's pickle.load(), the embedded payload can execute arbitrary code. The issue is therefore not in pickle deserialization itself, but in picklescan's incomplete detection logic, which can cause downstream systems or users to incorrectly trust a malicious serialized object.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker to bypass picklescan-based security checks and achieve arbitrary code execution when the malicious pickle is loaded with pickle.load(). This can lead to full compromise of the consuming Python process, including execution of attacker-controlled commands, theft or modification of data accessible to that process, service compromise, and potential supply-chain impact in workflows that ingest serialized Python objects such as ML models, APIs, or automation pipelines.

Mitigation

If you can’t patch tonight, do this now.

Do not rely solely on picklescan results to establish pickle safety. Avoid loading untrusted pickle files wherever possible. Until patched versions are deployed, apply compensating controls such as sandboxed or isolated analysis of serialized objects, provenance and integrity verification for pickle artifacts, stricter admission controls for externally sourced models or serialized data, and reduction or elimination of unsafe pickle deserialization in production workflows.

Remediation

Patch, then assume compromise.

Upgrade picklescan to version 0.0.29 or later, which addresses the missing detection for malicious idlelib.calltip.Calltip.fetch_tip usage. Additionally, review previously scanned or trusted pickle artifacts that may have been approved by vulnerable versions of picklescan, and reassess any workflows that deserialize pickle content from external or untrusted sources.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5

Community discussion across Reddit, Mastodon, and other social sources.