CVE-2025-71361: picklescan detection bypass via idlelib.calltip.Calltip.fetch_tip

CVE-2025-71361 · Severity: high · CVSS 8.1 · Published 2026-06-24

Picklescan is a security tool used to detect malicious code hidden within Python pickle files, which are commonly used to store machine learning models. A vulnerability was found where the tool fails to detect a specific type of malicious code that uses a built-in Python library function. If an attacker successfully bypasses this scan, they could execute unauthorized commands on a victim's system when the malicious model is loaded, potentially leading to a full system compromise or data theft.

Technologies: picklescan (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-71361 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-71361 being exploited in the wild.
How severe is CVE-2025-71361?
High severity, with a CVSS score of 8.1, published 24 June 2026.
Which products and versions are affected?
picklescan (PyPI) < 0.0.29, ECOSYSTEM:introduced=0,fixed=0.0.29.
Is there a fix for CVE-2025-71361?
Yes. picklescan (PyPI): upgrade to 0.0.29 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-71361 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-71361?
Check whether you run picklescan (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • picklescan (PyPI): upgrade to 0.0.29 or later
    pip install "picklescan>=0.0.29"

Technical details

Picklescan versions prior to 0.0.29 contain a detection bypass vulnerability. The tool fails to flag the use of 'idlelib.calltip.Calltip.fetch_tip' within a pickle file's __reduce__ method. This specific function eventually calls 'eval()' on its input. An attacker can craft a malicious pickle file that, when scanned by Picklescan, appears safe but executes arbitrary Python code (e.g., via os.system) when deserialized using 'pickle.load()'. This bypass is particularly relevant for supply chain attacks involving PyTorch models or other serialized Python objects. The issue is fixed in version 0.0.29.

Affected products

  • mmaitre314 picklescan < 0.0.29

Identifiers

  • CVE-2025-71361
  • GHSA-8r4j-24qv-fmq9
  • PYSEC-2026-1786

Timeline

  • 2025-08-26: advisory: GitHub Advisory published
  • 2025-08-26: patched: Fix released in version 0.0.29

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.