Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions

SummaryUsing idlelib.autocomplete.AutoComplete.fetchcompletions, which is a built-in python library function to execute remote pickle file. DetailsThe attack payload executes in the following steps:First, the attacker craft the payload by calling to...

CVE-2025-71376: Deserialization of Untrusted Data

picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetchcompletions in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims...