CVE-2025-71354

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.29

Description An issue exists where the software fails to detect malicious pickle files that utilize the SetText function within idlelib.debugobj.ObjectTreeItem inside reduce methods. Attackers can craft pickle files with embedded code that bypasses detection, leading to remote code execution when pickle.load() is called. This can be used in supply chain attacks by distributing infected pickle files across machine learning models, APIs, or saved Python objects.

Recommendations Update to version 0.0.29 or later.