The vulnerability identified as CVE-2025-71373 affects picklescan versions prior to 0.0.33. The tool fails to detect the use of operator.methodcaller function calls within pickle files. This failure permits attackers to bypass security checks implemented by picklescan, enabling the creation of malicious pickle payloads that execute arbitrary code upon deserialization. This poses a significant risk to systems that depend on picklescan to validate pickle data and prevent code execution attacks.

Systems using picklescan versions before 0.0.33 for validation of pickle files are vulnerable to remote code execution attacks. Attackers can craft pickle payloads with operator.methodcaller calls that bypass picklescan's detection, leading to arbitrary code execution and potential full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid relying solely on picklescan versions before 0.0.33 for security validation of pickle files. Consider additional security controls or alternative validation methods to mitigate risk.