CVE-2025-71321: picklescan blocklist bypass

CISO Take

picklescan, the widely-used ML model scanner specifically built to prevent pickle-based attacks, contains a critical bypass (CVSS 9.8) that allows attackers to invoke distutils.file_util.write_file and circumvent its dangerous-operations blocklist entirely. The threat inversion here is the key risk: organizations running picklescan as a security gate in their model-ingestion pipelines are now themselves the attack surface — the scan act is what triggers the exploit, not the subsequent model load. With no authentication, no user interaction, and network-level access required only to deliver the malicious file, any CI/CD pipeline or MLOps platform that accepts .pkl files from external contributors is directly exposed. No public exploit exists yet and it is not in CISA KEV, but with 68 prior CVEs in this package and a well-understood vulnerability class, weaponization is within reach of any attacker with pickle expertise; upgrade to picklescan ≥0.0.33 immediately and treat all pre-patch scan results as untrustworthy.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Critical risk for any ML team relying on picklescan as a security control. The vulnerability profile is maximally hostile: network-accessible, zero authentication, zero user interaction, low complexity — the full CVSS 9.8 triple-high reflects this accurately. The compounding factor is trust inversion: picklescan is deployed precisely because teams believe models are safe after scanning; a bypass means the protection layer silently converts into an attack surface without any visible indicator of compromise. Automated scanning pipelines that consume models from model hubs, open-source contributors, or third-party vendors face immediate RCE risk on the scanning host. The 68 prior CVEs in this package signal a recurring pattern of security gaps in the tool, warranting an architectural review of whether pickle-based scanning alone is sufficient defense.

How does the attack unfold?

Craft malicious pickle

Adversary constructs a .pkl file that uses distutils.file_util.write_file to bypass picklescan's dangerous-operations blocklist while embedding a file-overwrite or shell payload.

AML.T0011.000

Deliver to scanning pipeline

The malicious pickle is submitted via a model hub upload, pull request, or direct API call to any system that automatically runs picklescan on untrusted input before model consumption.

AML.T0010.001

Blocklist bypass triggers execution

picklescan deserializes the payload during scanning; distutils.file_util.write_file executes, evading the blocklist and writing attacker-controlled content to an arbitrary path on the scanning host.

AML.T0049

RCE or persistent file system compromise

Overwritten files — cron jobs, SSH authorized_keys, entrypoints — grant the adversary persistence or immediate code execution on the scan host, with downstream access to model artifacts, GPU clusters, and training infrastructure.

AML.T0072

Craft malicious pickle

Adversary constructs a .pkl file that uses distutils.file_util.write_file to bypass picklescan's dangerous-operations blocklist while embedding a file-overwrite or shell payload.

AML.T0011.000

Deliver to scanning pipeline

The malicious pickle is submitted via a model hub upload, pull request, or direct API call to any system that automatically runs picklescan on untrusted input before model consumption.

AML.T0010.001

Blocklist bypass triggers execution

picklescan deserializes the payload during scanning; distutils.file_util.write_file executes, evading the blocklist and writing attacker-controlled content to an arbitrary path on the scanning host.

AML.T0049

RCE or persistent file system compromise

Overwritten files — cron jobs, SSH authorized_keys, entrypoints — grant the adversary persistence or immediate code execution on the scan host, with downstream access to model artifacts, GPU clusters, and training infrastructure.

AML.T0072

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
420 3 dependents Pushed 9d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 46% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Patch: Upgrade picklescan to ≥0.0.33 immediately — this is the only complete fix.
Isolate scanners: Run picklescan in a minimal container with a read-only filesystem and no network egress so that a bypass cannot reach critical paths; treat the scan host as untrusted until patched.
Audit history: Review scan logs for any pickle files processed before patching from untrusted sources; assume any such file may have been a weaponized attempt.
Complement with format alternatives: Adopt safetensors for model sharing wherever possible — it avoids pickle serialization entirely and eliminates this class of risk.
Detect: Monitor for unexpected file write events from scanning processes (auditd, eBPF-based tools) and alert on any outbound connections originating from model-scan jobs.
Defense-in-depth: Do not rely solely on picklescan; layer with static analysis (fickling) and sandbox deserialization in ephemeral VMs for untrusted sources.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution DoS Framework Model Training Data AML.T0010.001 - AI Software AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

A.6.2.6 - AI system supply chain security

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain effectiveness of risk controls

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71321?

picklescan, the widely-used ML model scanner specifically built to prevent pickle-based attacks, contains a critical bypass (CVSS 9.8) that allows attackers to invoke distutils.file_util.write_file and circumvent its dangerous-operations blocklist entirely. The threat inversion here is the key risk: organizations running picklescan as a security gate in their model-ingestion pipelines are now themselves the attack surface — the scan act is what triggers the exploit, not the subsequent model load. With no authentication, no user interaction, and network-level access required only to deliver the malicious file, any CI/CD pipeline or MLOps platform that accepts .pkl files from external contributors is directly exposed. No public exploit exists yet and it is not in CISA KEV, but with 68 prior CVEs in this package and a well-understood vulnerability class, weaponization is within reach of any attacker with pickle expertise; upgrade to picklescan ≥0.0.33 immediately and treat all pre-patch scan results as untrustworthy.

Is CVE-2025-71321 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71321, increasing the risk of exploitation.

How to fix CVE-2025-71321?

1. Patch: Upgrade picklescan to ≥0.0.33 immediately — this is the only complete fix. 2. Isolate scanners: Run picklescan in a minimal container with a read-only filesystem and no network egress so that a bypass cannot reach critical paths; treat the scan host as untrusted until patched. 3. Audit history: Review scan logs for any pickle files processed before patching from untrusted sources; assume any such file may have been a weaponized attempt. 4. Complement with format alternatives: Adopt safetensors for model sharing wherever possible — it avoids pickle serialization entirely and eliminates this class of risk. 5. Detect: Monitor for unexpected file write events from scanning processes (auditd, eBPF-based tools) and alert on any outbound connections originating from model-scan jobs. 6. Defense-in-depth: Do not rely solely on picklescan; layer with static analysis (fickling) and sandbox deserialization in ephemeral VMs for untrusted sources.

What systems are affected by CVE-2025-71321?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, CI/CD model scanning gates, MLOps platforms, model registries.

What is the CVSS score for CVE-2025-71321?

CVE-2025-71321 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.62%.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel servingCI/CD model scanning gatesMLOps platformsmodel registries

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util.write_file. Attackers can construct malicious pickle objects to overwrite critical system files and achieve denial of service or remote code execution.

Exploitation Scenario

An adversary targeting an ML engineering team submits a crafted model file to a public model hub used by the target organization, or opens a pull request against a shared model repository. The target's CI/CD pipeline automatically invokes picklescan as a security gate before any model is loaded for testing. The malicious .pkl file contains a pickle opcode sequence that calls distutils.file_util.write_file — a vector not present in picklescan's blocklist prior to 0.0.33. During the scan phase, before any verdict is returned, the payload executes and overwrites an SSH authorized_keys file or a cron entry on the scanning host. Because CI/CD scan workers in ML environments typically have broad network access to the GPU cluster, object storage buckets, and internal package registries, the attacker pivots freely from the foothold gained through the 'security' step itself.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.