CVE-2025-71342: picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. A

picklescan (a tool for detecting malicious code in pickle files, which are Python serialized objects) before version 0.0.30 has a vulnerability that allows attackers to hide malicious code in pickle files using a specific method (idlelib.run.Executive.runcode in reduce methods). When these files are loaded using pickle.load, the hidden code executes automatically, enabling RCE (remote code execution) and potential supply chain attacks on systems using PyTorch models.