CVE-2025-71369 | BDVDB-2026-345550 Detail

Description#

picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.utils.decoder.basichandlers in reduce methods, allowing attackers to bypass safety checks. Remote attackers can embed undetected malicious code in pickle files that executes during deserialization, enabling remote code execution.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-04Record published in the CVE List.
2. Version 22026-07-06Most recent update recorded in the CVE List.