Picklescan, a library used to detect malicious pickle files, has a detection gap when handling payloads that use the Python built-in function idlelib.autocomplete.AutoComplete.get_entity. An attacker can craft a pickle payload whose reduce method calls this function with a malicious command, which Picklescan does not flag as dangerous. Consequently, when a victim trusts Picklescan's assessment and loads the pickle file, the malicious code executes remotely. This vulnerability is tracked as CVE-2025-71358 and affects Picklescan versions before 0.0.29.

Any organization or individual using Picklescan to validate pickle files, especially in machine learning workflows involving PyTorch models, is at risk. The vulnerability enables attackers to embed malicious code in pickle files that evade detection and execute upon loading, potentially leading to remote code execution. This can facilitate supply chain attacks by distributing infected pickle files through ML models, APIs, or saved Python objects, compromising system integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should verify if Picklescan has released an official fix for versions prior to 0.0.29. Until a patch is available, avoid loading pickle files solely based on Picklescan's detection results if they originate from untrusted sources. Consider additional manual review or alternative detection methods for pickle file safety.