---
id: CVE-2025-71342
title: >-
  picklescan before 0.0.30 fails to detect malicious pickle files using
  idlelib.run.Executive.runcode in reduce methods
summary: >-
  picklescan before 0.0.30 fails to detect malicious pickle files using
  idlelib.run.Executive.runcode in reduce methods. Attackers can embed
  undetected code in pickle files that executes during pickle.load, enabling
  remote code execution i…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-502
published: '2026-07-04'
updated: '2026-07-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71342'
references:
  - url: >-
      https://github.com/mmaitre314/picklescan/security/advisories/GHSA-m869-42cg-3xwr
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/picklescan-undetected-remote-code-execution-via-idlelib-run-executive-runcode
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00613
epssPercentile: 0.47133
ingestedAt: '2026-07-04T21:57:46.824Z'
---

## Overview

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in pickle files that executes during pickle.load, enabling remote code execution in PyTorch models and supply chain attacks.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.