What is GHSA-mg57-j93w-g3c7?

GHSA-mg57-j93w-g3c7 is a security advisory published by GitHub Security Advisories with High severity. picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing...

Which CVE IDs does GHSA-mg57-j93w-g3c7 cover?

GHSA-mg57-j93w-g3c7 covers the following CVE IDs: CVE-2025-71341. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mg57-j93w-g3c7?

GHSA-mg57-j93w-g3c7 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-mg57-j93w-g3c7HighCVSS 8.1

picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing...

Vendor

GitHub Security Advisories

Published

June 23, 2026

Last Modified

June 23, 2026

🔗 CVE IDs covered (1)

CVE-2025-71341 →

📋 Description

picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to achieve remote code execution when the pickle file is loaded.

🔗 References (4)

https://github.com/mmaitre314/picklescan/security/advisories/GHSA-6vqj-c2q5-j97w
https://nvd.nist.gov/vuln/detail/CVE-2025-71341
https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-undetected-profile-profile-runctx
https://github.com/advisories/GHSA-mg57-j93w-g3c7