Skip to content
Threat Feed
Subscribe
high advisory

CVE-2025-71373: Picklescan Bypass via `operator.methodcaller` Leads to Arbitrary Code Execution

Remote attackers can bypass security checks in `picklescan` versions prior to 0.0.33 by crafting malicious pickle payloads utilizing `operator.methodcaller` function calls, which upon loading by systems relying on `picklescan` for validation, results in arbitrary code execution and system compromise.

CVE-2025-71373 details a critical vulnerability affecting picklescan versions before 0.0.33, a tool designed to validate the safety of Python pickle files. This flaw allows remote attackers to circumvent the security mechanisms by embedding operator.methodcaller function calls within crafted pickle files. picklescan fails to detect these specific calls, mistakenly deeming the malicious files as safe. Consequently, any system that processes these specially crafted pickle files and relies on the vulnerable picklescan for validation will execute the embedded arbitrary code upon loading the file, leading to full system compromise. This vulnerability carries a CVSS v3.1 base score of 8.1 (High), highlighting its severe impact and ease of exploitation.

Attack Chain

  1. An attacker crafts a malicious Python pickle file containing arbitrary code embedded within operator.methodcaller function calls.
  2. The attacker delivers this malicious pickle file to a target system, potentially via email, file upload functionality, or as part of a data exchange.
  3. The target system, which is configured to process Python pickle files, receives the malicious payload.
  4. The system invokes picklescan (version prior to 0.0.33) to validate the safety and integrity of the incoming pickle file.
  5. During validation, picklescan fails to correctly identify and flag the operator.methodcaller function calls as malicious, allowing the bypass of its security checks.
  6. The target application, erroneously assuming the pickle file is safe based on picklescan's flawed validation, proceeds to load the file into memory.
  7. Upon loading, the arbitrary code embedded within the operator.methodcaller context is executed on the target system.
  8. The attacker achieves arbitrary code execution, leading to system compromise, which can involve data exfiltration, further persistence, or other malicious actions.

Impact

Successful exploitation of CVE-2025-71373 grants remote attackers arbitrary code execution capabilities on affected systems. Organizations utilizing picklescan for validating pickle files, particularly in data processing pipelines or applications handling untrusted serialized Python objects, are at risk. This could lead to complete compromise of the affected servers or workstations, potentially resulting in data breaches, installation of malware, or disruption of critical services. The CVSS score of 8.1 reflects the high severity, indicating that an unauthenticated attacker can achieve high confidentiality and integrity impact with low attack complexity.

Recommendation

  • Immediately update picklescan to version 0.0.33 or later to patch CVE-2025-71373.
  • Ensure all applications handling Python pickle files validate their source and integrity rigorously, even when using security scanners.
  • Implement robust input validation and sanitization for all external inputs, especially those that might involve deserialization of data, to prevent malicious pickle files from being processed.