7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-71344

CVE-2025-71344: picklescan - Arbitrary Code Execution via Undetected ensurepip._run_pip Function

picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing attackers to execute arbitrary code. Malicious pickle files embedding ensurepip._run_pip calls in reduce methods bypass picklescan detection and achieve remote code execution upon pickle.load() invocation.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-71344

CVE-2025-71344:

7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
picklescan	pip	< 0.0.30	0.0.30

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the picklescan tool's failure to detect a malicious pickle that uses ensurepip._run_pip for code execution. The tool relies on a predefined list of dangerous modules and functions to identify threats. The patch, found in commit 1931c2d04eaca8d20597705ff39cab78ba364e4b, explicitly adds "ensurepip": {"_run_pip"} to this list within src/picklescan/scanner.py. The primary functions that consume this list to perform the actual scanning are scan_file_path and scan_pickle_bytes, as indicated by the library's structure and test cases. Before the patch, these functions would incorrectly classify a pickle file using this specific exploit vector as safe. Therefore, these scanning functions are considered 'vulnerable' in the sense that they were ineffective against this attack. An attacker could exploit this by providing a malicious pickle file that, when scanned by a vulnerable version of picklescan, would be marked as safe, potentially leading a user or automated system to load it and trigger remote code execution.

Vulnerable functions

scanner.scan_file_path

src/picklescan/scanner.py

This function was vulnerable because it failed to detect `ensurepip._run_pip` as a dangerous function when scanning pickle files. This omission allowed a specially crafted pickle file to bypass detection and execute arbitrary code when loaded. The patch fixes this by adding `ensurepip._run_pip` to the denylist.

scanner.scan_pickle_bytes

src/picklescan/scanner.py

This function was vulnerable because it failed to detect `ensurepip._run_pip` as a dangerous function when scanning pickle data from bytes. This omission allowed a specially crafted pickle to bypass detection and execute arbitrary code when loaded. The patch fixes this by adding `ensurepip._run_pip` to the denylist used by the scanner.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.