CVE-2025-71364: Deserialization of Untrusted Data

picklescan before 0.0.30 fails to detect the asyncio.unixevents.UnixSubprocessTransport.start function in pickle reduce methods, allowing remote code execution. Attackers can craft malicious pickle files embedding this built-in function that evade detection but execute arbitrary commands when...

PT-2025-36716

Summary Using asyncio.unix events. UnixSubprocessTransport. start function, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to asyncio.unix events...