What is GHSA-fcqg-3mwf-cfcf?

GHSA-fcqg-3mwf-cfcf is a security advisory published by GitHub Security Advisories with High severity. picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce...

Which CVE IDs does GHSA-fcqg-3mwf-cfcf cover?

GHSA-fcqg-3mwf-cfcf covers the following CVE IDs: CVE-2025-71378. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fcqg-3mwf-cfcf?

GHSA-fcqg-3mwf-cfcf has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-fcqg-3mwf-cfcfHighCVSS 8.1

picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce...

Vendor

GitHub Security Advisories

Published

June 21, 2026

Last Modified

June 21, 2026

🔗 CVE IDs covered (1)

CVE-2025-71378 →

📋 Description

picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().

🔗 References (4)

https://github.com/mmaitre314/picklescan/security/advisories/GHSA-9w88-8rmg-7g2p
https://nvd.nist.gov/vuln/detail/CVE-2025-71378
https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-undetected-cprofile-runctx-in-pickle-files
https://github.com/advisories/GHSA-fcqg-3mwf-cfcf