CVE-2025-71361

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.29

Description An issue exists where the software fails to detect malicious calls to the fetch tip() function within the idlelib.calltip.Calltip module in pickle files. This occurs because the fetch tip() function, a built-in Python library function, can be used in a reduce method to execute arbitrary code. An attacker can craft a payload that remains undetected during scanning, leading to remote code execution when the malicious pickle file is processed via pickle.load().

Recommendations Update to version 0.0.29 or later.