{"data":{"id":"292fff7e-25c3-4354-a91e-1fceadf3d021","title":"CVE-2025-71342: picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods…","summary":"CVE-2025-71342 affects picklescan before 0.0.30, which fails to detect malicious pickle files that use idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code that executes during pickle.load, enabling remote code execution in PyTorch models and supply chain attacks. VulnCheck rates it CVSS 4.0 7.6 HIGH, and NIST has not yet provided an assessment.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71342","publishedAt":"2026-07-04T02:16:21.387Z","cveId":"CVE-2025-71342","cweIds":["CWE-502"],"cvssScore":"8.1","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["picklescan","PyTorch"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"picklescan fails to detect malicious pickles via idlelib.run.Executive.runcode","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00543,"epssCheckedAt":"2026-10-14T06:09:05.323Z","kevDateAdded":null,"advisoryAliases":["GHSA-j6fw-8849-4cxh"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:47:05.483Z","patchAvailable":null,"disclosureDate":"2026-07-04T02:16:21.387Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"model","llmSpecific":false,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":["AML.T0010"]}}