Picklescan, a library used to detect malicious pickle files, does not detect payloads that use the built-in Python function ensurepip._run_pip to execute remote pickle files. An attacker crafts a malicious pickle payload that calls ensurepip._run_pip in its __reduce__ method. When Picklescan fails to detect this as dangerous, the victim may load the pickle file using pickle.load(), resulting in remote code execution. This vulnerability affects Picklescan versions before 0.0.30 and is tracked as CVE-2025-71344.

Attackers can embed malicious code in pickle files that evade detection by Picklescan and execute upon loading. This can lead to remote code execution in environments that trust Picklescan's validation, including machine learning workflows and APIs that load pickle files. The vulnerability enables supply chain attacks by distributing infected pickle files within PyTorch models or other Python objects. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid relying solely on Picklescan versions prior to 0.0.30 for detecting malicious pickle files involving ensurepip._run_pip. Until an official fix is available, consider additional validation or sandboxing when loading pickle files from untrusted sources.