CVE-2025-71358

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.29

Description An issue exists where the software fails to detect malicious pickle files that utilize the get entity() function within the idlelib.autocomplete.AutoComplete module in reduce methods. This allows attackers to embed undetected code in pickle files that executes arbitrary commands when loaded by victims using the pickle.load() function. This can lead to remote code execution, potentially affecting organizations or individuals using the tool to scan PyTorch models, APIs, or saved Python objects.

Recommendations Update to version 0.0.29 or later.