7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-71361

CVE-2025-71361: picklescan - Remote Code Execution via Undetected idlelib.calltip.Calltip.fetch_tip

picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle files, allowing remote code execution. Attackers can embed undetected payloads in pickle files that execute arbitrary code when loaded via pickle.load().

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-71361

CVE-2025-71361:

7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
picklescan	pip	< 0.0.29	0.0.29

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-8r4j-24qv-fmq9, is a blacklist bypass in the picklescan library. picklescan is designed to detect malicious pickle files by checking for the use of dangerous functions. However, in versions prior to 0.0.29, its blacklist was incomplete and did not include several dangerous functions from Python's standard library, including idlelib.calltip.Calltip.fetch_tip and idlelib.calltip.get_entity.

The core of the vulnerability is that these idlelib functions internally use eval() on their arguments, which is a well-known security risk as it allows for arbitrary code execution. An attacker can craft a pickle file that, upon being loaded, executes one of these functions with a malicious payload. Because vulnerable versions of picklescan do not recognize these functions as a threat, they would incorrectly certify the malicious file as safe.

An unsuspecting user, relying on picklescan's assessment, would then load the pickle file, triggering the payload and leading to remote code execution. The provided patch resolves this vulnerability by updating picklescan's dangerous_globals list in src/picklescan/scanner.py to include the newly identified dangerous functions from idlelib.calltip and other modules, thus ensuring they are correctly detected and flagged.

Vulnerable functions

Calltip.fetch_tip

src/picklescan/scanner.py

The vulnerability lies in `picklescan`'s failure to recognize `idlelib.calltip.Calltip.fetch_tip` as a dangerous function. This function, part of Python's standard library, can be abused to execute arbitrary code because it uses `eval()` on its input. An attacker can create a malicious pickle file that calls this function. When scanned by a vulnerable version of `picklescan`, the file is not flagged as malicious. When the user loads this pickle file, the `fetch_tip` function is executed, leading to remote code execution. The patch addresses this by adding `Calltip.fetch_tip` to the denylist of dangerous functions.

get_entity

src/picklescan/scanner.py

`get_entity` is another function in the `idlelib.calltip` module that was not blacklisted by `picklescan`. It is called by `Calltip.fetch_tip` and also uses `eval()`, making it a vector for arbitrary code execution. A malicious pickle can be crafted to use this function, bypassing `picklescan`'s security checks in vulnerable versions. The patch adds `get_entity` to the list of dangerous functions to prevent this exploitation vector.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.