Vulnerability Description
picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in pickle files that executes during pickle.load, enabling remote code execution in PyTorch models and supply chain attacks.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-m869-42cg-3xwr
- https://www.vulncheck.com/advisories/picklescan-undetected-remote-code-execution
- https://github.com/mmaitre314/picklescan/security/advisories/GHSA-m869-42cg-3xwr
FAQ
What is CVE-2025-71342?
CVE-2025-71342 is a vulnerability with a CVSS score of 8.1 (HIGH). picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in pickle files that executes during pickle.l...
How severe is CVE-2025-71342?
CVE-2025-71342 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-71342?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.