CVE-2025-71361: Remote Code Execution in Picklescan via idlelib.calltip Gadget Chain

Technical summary

The vulnerability stems from picklescan's incomplete detection logic for dangerous callable gadgets in serialized pickle objects. Specifically, the idlelib.calltip.Calltip.fetch_tip method can be abused during deserialization to invoke arbitrary code execution. Picklescan versions prior to 0.0.29 do not recognize this gadget chain, allowing malicious pickle files to pass validation undetected. The root cause is classified under CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code), a category covering sandbox escapes and gadget-chain attacks in deserialization contexts.

Business impact

Organizations relying on picklescan as a security control for untrusted pickle data face a critical gap in protection. If picklescan is deployed to validate pickles before processing—whether in data pipelines, API gateways, or model servers—an attacker can circumvent that control. The attacker gains code execution in the context of the process handling the pickle, potentially leading to data theft, lateral movement, or supply-chain compromise if the environment processes data from external sources.

Affected systems

Any deployment using picklescan versions before 0.0.29 to validate pickle files is affected. Notably, the vulnerability affects systems that rely on picklescan as a gating mechanism for untrusted serialized Python objects. The vulnerability does not directly affect the Python standard library's pickle module itself; rather, it undermines a third-party defensive tool. Organizations using picklescan for security validation are the primary risk group.

Exploitability

This vulnerability has a CVSS score of 8.1 (HIGH), with a network attack vector, low complexity, no privilege requirement, and user interaction. An attacker needs to deliver a malicious pickle file to a victim who loads it through picklescan. The attack requires the victim to take action (load the pickle), but once triggered, arbitrary code execution occurs in the victim's process. No special privileges or system knowledge is required; the exploit is straightforward for anyone familiar with pickle gadget chains.

Remediation

Upgrade picklescan to version 0.0.29 or later to restore detection of the idlelib.calltip.Calltip.fetch_tip gadget. Additionally, enforce defense-in-depth practices: (1) validate pickle files only from trusted sources; (2) consider sandboxing pickle deserialization; (3) apply principle of least privilege to processes that handle pickles; (4) monitor for unexpected code execution or subprocess spawning during pickle load operations.

Patch guidance

Apply picklescan version 0.0.29 or later as soon as possible. Verify the fix by checking the picklescan release notes and confirming that idlelib.calltip gadgets are now detected. Organizations should test the patched version in a staging environment to ensure no breaking changes before rolling out to production. Consider using dependency scanning tools to alert on out-of-date picklescan versions across your codebase.

Detection guidance

Search code repositories and runtime environments for picklescan versions < 0.0.29. Monitor system logs and application telemetry for unexpected subprocess creation, file access, or network connections originating from processes that load pickle files. Implement network segmentation to limit the blast radius if a pickle-processing service is compromised. Use static analysis to identify code paths where pickle.load() or picklescan.scan() are called on untrusted data sources.

Why prioritize this

While not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, the high CVSS score (8.1), ease of exploitation, and the fact that picklescan is a security control (whose failure is catastrophic) make this a high-priority patch. Organizations that use picklescan should treat this as urgent. Delay increases the window during which an attacker could exploit the gap with minimal detection.

Risk score, explained

The score of 8.1 reflects the combination of network exploitability, high impact on confidentiality and integrity, and the requirement for only a low barrier to entry (user interaction via loading a file). The absence of availability impact prevents a critical score, but the direct path to code execution and the bypassing of a security tool elevate the severity to HIGH. Contextualize this as affecting a defensive tool, which magnifies organizational risk if picklescan is a core part of your security posture.

Frequently asked questions