CVE-2025-71358: picklescan detection bypass via idlelib get_entity function

Executive brief

Picklescan is a security tool used to detect malicious code hidden in Python "pickle" files, which are commonly used to store machine learning models. A vulnerability was found where certain malicious commands could bypass detection by using a specific Python library function. If a user relies on Picklescan to verify a file and then opens it, an attacker could execute arbitrary code on the user's system.

Technical details

Picklescan (versions prior to 0.0.29) contains a detection bypass vulnerability. The tool fails to flag malicious pickle files that use the `idlelib.autocomplete.AutoComplete.get_entity` function within a `__reduce__` method to execute arbitrary system commands. An attacker can craft a malicious pickle file (such as a PyTorch model) that passes Picklescan's security checks but executes code via `pickle.load()`. This is a bypass of the library's primary security function. The issue is resolved in version 0.0.29.

Affected products

• mmaitre314 picklescan < 0.0.29

Timeline

• 2025-08-26: disclosed
• 2025-08-26: advisory
• 2025-08-26: patched: Fixed in version 0.0.29

References

• https://api.github.com/users/FredericDT
• https://github.com/FredericDT
• https://api.github.com/users/FredericDT/gists%7B/gist_id%7D
• https://api.github.com/users/FredericDT/repos
• https://avatars.githubusercontent.com/u/16513314?v=4
• https://api.github.com/users/FredericDT/events%7B/privacy%7D