Picklescan has a missing detection when calling built-in python profile.Profile.runctx

SummaryUsing profile.Profile.runctx, which is a built-in python library function to execute remote pickle file. DetailsThe attack payload executes in the following steps:First, the attacker craft the payload by calling to profile.Profile.runctx function in reduce methodThen when the victim after...

CVE-2025-71341: Deserialization of Untrusted Data

picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to achieve remote code execution whe...