7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-71358

CVE-2025-71358: picklescan - Remote Code Execution via idlelib.autocomplete.AutoComplete.get_entity

picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims using pickle.load().

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-71358

CVE-2025-71358:

7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
picklescan	pip	< 0.0.29	0.0.29

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in picklescan's failure to detect malicious code that uses the idlelib.autocomplete.AutoComplete.get_entity function. picklescan operates by checking for known dangerous "globals" (functions/classes) within a pickle file. The vulnerability was that this list of dangerous globals was incomplete. The patch, found in commit aecd11be98702caa9ba9b12189d91ad596a36114, rectifies this by adding idlelib.autocomplete.AutoComplete.get_entity and other similar functions to the dangerous_globals dictionary in src/picklescan/scanner.py.

The functions that use this dictionary for scanning are the ones considered vulnerable. Based on the test files, these are scan_file_path and scan_pickle_bytes. When these functions are called on a malicious pickle file containing the AutoComplete.get_entity payload, they would fail to identify it as a threat prior to the patch.

Therefore, during a security scan using a vulnerable version of picklescan, these functions would appear in a runtime profile, but they would not raise any security alerts for the specific payload, effectively bypassing the scanner. The exploitation of the malicious pickle itself happens later when pickle.load() is called by the end-user application, which in turn executes idlelib.autocomplete.AutoComplete.get_entity. The vulnerability in picklescan is the failure of its scanning functions to prevent this.

Vulnerable functions

picklescan.scanner.scan_file_path

src/picklescan/scanner.py

This function is responsible for scanning pickle files for dangerous content. It uses a dictionary of dangerous globals to identify malicious code. Before the patch, this dictionary was missing `idlelib.autocomplete.AutoComplete.get_entity`. As a result, the function would not detect pickle files that use this function for remote code execution, leading to a bypass of the scanner.

picklescan.scanner.scan_pickle_bytes

src/picklescan/scanner.py

This function is responsible for scanning pickle data from bytes for dangerous content. It likely uses the same `dangerous_globals` dictionary as `scan_file_path`. Before the patch, this dictionary was missing `idlelib.autocomplete.AutoComplete.get_entity`. As a result, the function would not detect pickle data that uses this function for remote code execution, leading to a bypass of the scanner.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.