CVE-2025-71342: picklescan - Undetected Remote Code Execution via idlelib.run.Executive.runcode
picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in pickle files that executes during pickle.load, enabling remote code execution in PyTorch models and supply chain attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
picklescanto a version that resolves this vulnerability.Fixed in 0.0.30 - Compensating control
Use picklescan version 0.0.30 or later to scan pickle files for undetected remote code execution via idlelib.run.Executive.runcode in reduce methods.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71342?
CVE-2025-71342 has a high severity score of 8.1.
How do I fix CVE-2025-71342?
To mitigate CVE-2025-71342, upgrade picklescan to version 0.0.30 or later.
What is the impact of CVE-2025-71342 on my system?
CVE-2025-71342 allows attackers to execute remote code through malicious pickle files, posing a significant security risk.
Which software is affected by CVE-2025-71342?
CVE-2025-71342 affects picklescan versions prior to 0.0.30.
What type of attack does CVE-2025-71342 enable?
CVE-2025-71342 can enable remote code execution and supply chain attacks through undetected malicious code in pickle files.