CVE-2025-71321: Picklescan

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util.write_file. Attackers can construct malicious pickle objects to overwrite critical system files and achieve denial of service or remote code execution.

Affected products

• Picklescan Picklescan: before 0.0.33 (fixed in 0.0.33)

Published 2026-06-17. Last modified 2026-10-05.