CVE-2025-71358

picklescan - Remote Code Execution via idlelib.autocomplete.AutoComplete.get_entity

Published Jun 22, 2026 CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Description

picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims using pickle.load().

Analysis

Technical impact

picklescan before 0.0.29 does not detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity in reduce methods. An attacker can embed code that runs arbitrary commands when the file is loaded by pickle.load, giving the attacker full control of the system and compromising confidentiality, integrity, and availability.

Affected Systems

The vulnerability affects picklescan versions prior to 0.0.29, produced by mmaitre314. Users running any pre‑0.0.29 release are susceptible; newer releases contain the fix.

Risk and Exploitability

The CVSS score is 7.6 and no EPSS data is available. The vulnerability is not listed in CISA KEV. Because it is triggered when a user loads a crafted pickle file, the attack vector is local/file‑based; the attacker must supply a malicious file to a victim who uses pickle.load. The impact is significant, but exploitation requires user interaction and is not remotely server‑side.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

picklescan

unaffected

Version	Status	Constraints
`0`	affected	< 0.0.29
`0.0.29`	unaffected	—

No data.

Vendor Product Versions

Mmaitre314

Picklescan

Version	Status	Scheme	Platform
`[0,0.0.29)`	affected	generic	—
`0.0.29`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade picklescan to version 0.0.29 or later.
Avoid loading pickle files from untrusted sources; disable or guard pickle.load usage if the functionality is unnecessary.
Validate or sandbox pickle files before loading them, or replace pickle.load with a safer deserialization mechanism.

Generated by OpenCVE AI on June 22, 2026 at 23:29 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-6w4w-5w54-rjvr	Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.314% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/mmaitre314/picklescan/security/advisories/GHSA-6w4w-5w54-rjvr
https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-idlelib-autocomplete-autocomplete-get-entity

History

Jun 23, 2026 12:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 22, 2026 10:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims using pickle.load().
Title		picklescan - Remote Code Execution via idlelib.autocomplete.AutoComplete.get_entity
First Time appeared		Mmaitre314 Mmaitre314 picklescan
Weaknesses		CWE-502
CPEs		cpe:2.3:a:mmaitre314:picklescan::::::::
Vendors & Products		Mmaitre314 Mmaitre314 picklescan
References		https://github.com/mmaitre314/picklescan/security/advisories/GHSA-6w4w-5w54-rjvr https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-idlelib-autocomplete-autocomplete-get-entity
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`