CVE-2025-71320: picklescan deny-list bypass

CISO Take

picklescan, the Python tool widely deployed as a security gate to detect malicious pickle payloads in ML model pipelines, contains an incomplete blocklist that fails to block the `pydoc.locate` and `operator.methodcaller` functions, giving attackers a documented path to smuggle arbitrary code execution payloads through the scanner undetected. The danger is compounded by false confidence: teams relying on picklescan as their sole defense for untrusted model loading—common in workflows pulling models from HuggingFace Hub or internal registries—are exposed without knowing their gate is defeated. With a CVSS of 9.8 (network-exploitable, no authentication, no user interaction required), and 68 prior CVEs already logged against the same package signaling a pattern of incomplete hardening, this demands immediate action on any MLOps pipeline that processes external or community-sourced model files. Upgrade to picklescan ≥ 0.0.33 immediately and treat any prior scan results from unpatched versions as potentially unreliable.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Critical. CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects maximum exploitability: the attack is network-triggered, requires no privileges, and demands no user interaction beyond the normal model loading workflow. The bypass targets a security control rather than a general-purpose application, meaning exploitation directly negates a deployed risk mitigation layer — arguably more dangerous than a vulnerability in a non-security tool. Although not in CISA KEV and no public exploit is confirmed at publication time, the technique relies on documented Python standard library functions (pydoc, operator modules), lowering the barrier for independent rediscovery and weaponization to moderate-skill attackers. The 68 prior CVEs in this package are a material signal for risk assessments.

How does the attack unfold?

Craft malicious payload

Attacker constructs a pickle file that invokes pydoc.locate or operator.methodcaller to execute arbitrary OS commands, specifically choosing functions absent from picklescan's deny-list.

AML.T0011.000

Bypass security scanner

The malicious pickle file passes picklescan's incomplete blocklist check cleanly, receiving a false-positive clean result and proceeding through the validation gate without triggering any alert.

AML.T0107

Supply chain injection

Attacker distributes the cleared malicious model file via a public model registry, HuggingFace repository, or compromised internal artifact store, targeting downstream consumers.

AML.T0010.001

Code execution on deserialization

Victim's ML pipeline deserializes the model file, triggering arbitrary code execution with the privileges of the worker process and enabling full host compromise including credential theft and lateral movement.

AML.T0018.002

Craft malicious payload

Attacker constructs a pickle file that invokes pydoc.locate or operator.methodcaller to execute arbitrary OS commands, specifically choosing functions absent from picklescan's deny-list.

AML.T0011.000

Bypass security scanner

The malicious pickle file passes picklescan's incomplete blocklist check cleanly, receiving a false-positive clean result and proceeding through the validation gate without triggering any alert.

AML.T0107

Supply chain injection

Attacker distributes the cleared malicious model file via a public model registry, HuggingFace repository, or compromised internal artifact store, targeting downstream consumers.

AML.T0010.001

Code execution on deserialization

Victim's ML pipeline deserializes the model file, triggering arbitrary code execution with the privileges of the worker process and enabling full host compromise including credential theft and lateral movement.

AML.T0018.002

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
420 3 dependents Pushed 9d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 46% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Upgrade picklescan to version 0.0.33 or later immediately — this release extends the deny-list to cover pydoc.locate and operator.methodcaller.
Until patched, do not rely solely on picklescan for untrusted model files; treat all prior scan results from unpatched versions as incomplete.
Migrate model serialization to safetensors where possible — it is format-safe by design and eliminates the pickle attack surface entirely.
Audit CI/CD pipelines and model loading scripts: run 'pip show picklescan' or inspect lock files to confirm which version is pinned across all environments.
For detection, monitor for unexpected subprocess or network activity spawned from model loading code paths; any process execution during deserialization is a strong indicator of exploitation.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model Framework AML.T0010.001 - AI Software AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.1.2 - AI supply chain management

NIST AI RMF

MANAGE-2.2 - Risk treatment mechanisms

OWASP LLM Top 10

LLM05:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71320?

picklescan, the Python tool widely deployed as a security gate to detect malicious pickle payloads in ML model pipelines, contains an incomplete blocklist that fails to block the `pydoc.locate` and `operator.methodcaller` functions, giving attackers a documented path to smuggle arbitrary code execution payloads through the scanner undetected. The danger is compounded by false confidence: teams relying on picklescan as their sole defense for untrusted model loading—common in workflows pulling models from HuggingFace Hub or internal registries—are exposed without knowing their gate is defeated. With a CVSS of 9.8 (network-exploitable, no authentication, no user interaction required), and 68 prior CVEs already logged against the same package signaling a pattern of incomplete hardening, this demands immediate action on any MLOps pipeline that processes external or community-sourced model files. Upgrade to picklescan ≥ 0.0.33 immediately and treat any prior scan results from unpatched versions as potentially unreliable.

Is CVE-2025-71320 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71320, increasing the risk of exploitation.

How to fix CVE-2025-71320?

1. Upgrade picklescan to version 0.0.33 or later immediately — this release extends the deny-list to cover pydoc.locate and operator.methodcaller. 2. Until patched, do not rely solely on picklescan for untrusted model files; treat all prior scan results from unpatched versions as incomplete. 3. Migrate model serialization to safetensors where possible — it is format-safe by design and eliminates the pickle attack surface entirely. 4. Audit CI/CD pipelines and model loading scripts: run 'pip show picklescan' or inspect lock files to confirm which version is pinned across all environments. 5. For detection, monitor for unexpected subprocess or network activity spawned from model loading code paths; any process execution during deserialization is a strong indicator of exploitation.

What systems are affected by CVE-2025-71320?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, MLOps pipelines, model registries, CI/CD model validation gates.

What is the CVSS score for CVE-2025-71320?

CVE-2025-71320 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.62%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesMLOps pipelinesmodel registriesCI/CD model validation gates

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.2

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when the pickle is deserialized.

Exploitation Scenario

An adversary targeting an organization's model supply chain crafts a malicious pickle file that uses pydoc.locate to resolve os.system and invoke a reverse shell command, or constructs an operator.methodcaller chain to the same effect. The file is packaged as a convincing model checkpoint (e.g., model.pkl or pytorch_model.bin renamed) and published to a public HuggingFace repository, injected into an internal artifact store via a compromised contributor account, or distributed through a poisoned dependency. When the victim's MLOps pipeline runs picklescan on the file before loading, it passes cleanly. The pipeline proceeds to deserialize the file, triggering remote code execution with the privileges of the ML worker process — granting the attacker access to training data, proprietary model weights, environment variables containing cloud credentials, and lateral movement paths across the ML cluster.

Weaknesses (CWE)

CWE-184 Incomplete List of Disallowed Inputs CWE-184 Incomplete List of Disallowed Inputs

CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

[Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE corpus.