What is GHSA-h96j-r2w4-m289?

GHSA-h96j-r2w4-m289 is a security advisory published by GitHub Security Advisories with High severity. picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter...

Which CVE IDs does GHSA-h96j-r2w4-m289 cover?

GHSA-h96j-r2w4-m289 covers the following CVE IDs: CVE-2025-71371. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h96j-r2w4-m289?

GHSA-h96j-r2w4-m289 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-h96j-r2w4-m289HighCVSS 8.1

picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter...

Vendor

GitHub Security Advisories

Published

July 1, 2026

Last Modified

July 1, 2026

🔗 CVE IDs covered (1)

CVE-2025-71371 →

📋 Description

picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().

🔗 References (4)

https://github.com/mmaitre314/picklescan/security/advisories/GHSA-cj3c-v495-4xqh
https://nvd.nist.gov/vuln/detail/CVE-2025-71371
https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-code-interactiveinterpreter-detection-bypass
https://github.com/advisories/GHSA-h96j-r2w4-m289