---
id: CVE-2025-71373
title: >-
  picklescan before 0.0.33 fails to detect operator.methodcaller function calls
  in pickle files, allowing attackers to bypass security checks
summary: >-
  picklescan before 0.0.33 fails to detect operator.methodcaller function calls
  in pickle files, allowing attackers to bypass security checks. Remote
  attackers can craft malicious pickle payloads using operator.methodcaller that
  execute ar…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-693
published: '2026-07-04'
updated: '2026-07-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71373'
references:
  - url: >-
      https://github.com/mmaitre314/picklescan/security/advisories/GHSA-x843-g5mx-g377
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/picklescan-remote-code-execution-via-operator-methodcaller-detection-bypass
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00637
epssPercentile: 0.48435
ingestedAt: '2026-07-04T21:57:46.855Z'
---

## Overview

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on picklescan for validation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.