CVE-2025-71360: Picklescan Detection Bypass via idlelib.calltip.get_entity

Technical summary

CVE-2025-71360 exploits a gap in picklescan's scanning logic. Python's pickle format supports 'reduce' operations that reconstruct objects by calling arbitrary callables. The vulnerability leverages idlelib.calltip.get_entity, a function from Python's standard library, as a gadget that picklescan fails to recognize as dangerous. By embedding this function call in a reduce method, an attacker bypasses picklescan's allowlist-based detection. The resulting pickle file appears safe to the scanner but executes arbitrary code when unpickled. The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impact (remote code execution) with low attack complexity and no authentication requirement, though user interaction is needed to load the malicious pickle.

Business impact

Organizations relying on picklescan as a security control for deserializing untrusted pickle data face potential remote code execution within their applications. This is particularly critical for systems that accept pickle-serialized data from external sources—such as machine learning model servers, data pipeline tools, or inter-service communication frameworks. A successful attack could lead to data exfiltration, lateral movement, service disruption, or supply-chain compromise if malicious pickles are embedded in third-party libraries or artifacts. The false sense of security from a compromised scanner makes this especially dangerous.

Affected systems

Picklescan versions before 0.0.29 are vulnerable. Any application using an affected version of picklescan to validate pickle files before deserialization is at risk. This includes Python environments that deserialize pickle data as part of web services, data science workflows, configuration management, or inter-process communication. The vulnerability does not directly affect Python's pickle module itself, but rather the detection tool intended to protect against pickle-based attacks.

Exploitability

Exploitation requires an attacker to deliver a malicious pickle file to a victim application that: (1) uses a vulnerable version of picklescan to validate the file, (2) trusts picklescan's verdict and deserializes the file. The attack requires user interaction in the sense that someone must load the pickle; however, this could be automated in many application contexts (e.g., a web service automatically processing uploaded files, or a pipeline loading cached model artifacts). The attack surface is broad given pickle's prevalence in Python ecosystems, and the crafting of a bypass payload is within the capability of determined threat actors once details are public.

Remediation

Upgrade picklescan to version 0.0.29 or later immediately. This patched version closes the detection gap by properly recognizing idlelib.calltip.get_entity and related gadgets. Additionally, organizations should review their pickle deserialization architecture: prefer safer serialization formats (JSON, Protocol Buffers, MessagePack) where feasible, implement defense-in-depth (sandboxing, least-privilege execution), and maintain strict input validation independent of picklescan's output.

Patch guidance

Update picklescan to version 0.0.29 or newer as a priority patch. Verify the update via the official picklescan repository (GitHub, PyPI) to confirm authenticity. If your application pins picklescan version in a requirements file or dependency manifest, regenerate your lock files and test thoroughly in a staging environment before production deployment. Check that your pickle validation logic is using the updated picklescan library and not caching old detection results.

Detection guidance

Monitor for: (1) Unusual pickle file deserialization attempts in applications using picklescan, especially if preceded by picklescan validation; (2) Execution of unexpected child processes or remote connections following pickle loading; (3) Version checks on picklescan dependencies in deployed environments to ensure 0.0.29+ is in use; (4) Logs showing idlelib imports or calltip function invocations in unexpected contexts; (5) Changes to pickle files in transit or at rest, particularly those claiming to be validated by older picklescan versions.

Why prioritize this

This vulnerability merits immediate attention because it directly undermines a widely-trusted security control. Picklescan's purpose is to block malicious pickle deserialization; its compromise enables precisely the attacks it was designed to prevent. The high CVSS score, low attack complexity, and network attack vector combine with the tool's defensive role to create urgent risk. Organizations should prioritize patching before attackers weaponize public proof-of-concepts or incorporate this bypass into automated attack tooling.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: Network attack vector (AV:N) because malicious pickles can be delivered remotely; Low attack complexity (AC:L) as the bypass requires no special conditions once crafted; No privilege requirement (PR:N) since pickle loading does not require elevated access; User interaction required (UI:R) meaning a victim must load the pickle, though this is often automated; Unchanged scope (S:U); High confidentiality impact (C:H) from arbitrary code execution allowing data theft; High integrity impact (I:H) from code execution enabling system modification; No availability impact (A:N) since RCE doesn't inherently crash services. The score does not account for picklescan's defensive role, which contextually elevates risk.

Frequently asked questions