Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in pickle files that executes during pickle.load, enabling remote code execution in PyTorch models and supply chain attacks.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you're scanning PyTorch models with picklescan, you have a blind spot. CVE-2025-71342 is a scanner bypass that lets attackers embed undetected code in pickle files. Here's what to check Monday.
Post summary
CVE-2025-71342 is a scanner bypass that allows attackers to embed hidden code into PyTorch pickle files, bypassing picklescan checks.