CVE-2025-71322: picklescan pty.spawn bypass enables

Q: Is CVE-2025-71322 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71322, increasing the risk of exploitation.

Q: How to fix CVE-2025-71322?

1. Upgrade PickleScan to version 0.0.33 or later immediately — this release adds `pty.spawn` to the unsafe globals list. 2. Re-scan all model files previously approved by PickleScan < 0.0.33 before loading them in any environment. 3. As defense-in-depth, run model deserialization inside isolated sandboxes (gVisor, Firecracker, or ephemeral containers) regardless of scan results. 4. Evaluate `fickling` (Trail of Bits) as a secondary validator — it performs AST-level analysis independent of a fixed unsafe globals list. 5. For detection: search model files for `pty` string references as a lightweight pre-check; review PickleScan audit logs for any files scanned with versions below 0.0.33 that were subsequently loaded.

Q: What systems are affected by CVE-2025-71322?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, MLOps pipelines, model registries, CI/CD security gates.

Q: What is the CVSS score for CVE-2025-71322?

CVE-2025-71322 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.38%.

CISO Take

PickleScan, the de-facto tool for detecting malicious pickle payloads in ML model files, fails to flag Python's `pty.spawn` function as dangerous, allowing adversaries to craft model checkpoints that pass security scanning while still executing arbitrary code when loaded. This is an especially corrosive vulnerability class: it targets the security control itself, meaning every team relying on PickleScan to gate model loading is operating with a false sense of safety. Attack complexity is low and the impact is full C/I/A compromise (CVSS 8.8), though user interaction is required and no public exploit is currently reported. Upgrade to PickleScan ≥ 0.0.33 immediately and re-scan any model files previously cleared by older versions before loading them.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High risk for AI/ML teams that use PickleScan as a security gate in model validation workflows. The vulnerability defeats the primary defense against pickle-based code execution — the exact threat PickleScan was built to prevent — with low attack complexity once the bypass technique is known. The 68 prior CVEs in the same package and a package risk score of 53/100 signal a historically security-troubled codebase. Direct downstream dependents are limited to 3, reducing ecosystem blast radius, but the qualitative impact per affected organization is severe: any pipeline trusting a PickleScan clean result for a maliciously crafted file is fully exposed to RCE on the host running the scan.

How does the attack unfold?

Craft Malicious Artifact

Attacker crafts a pickle-based model checkpoint embedding a `pty.spawn` payload that invokes a reverse shell, deliberately using a function absent from PickleScan's unsafe globals list.

AML.T0011.000

Defense Evasion via Scanner Bypass

The malicious file passes PickleScan validation cleanly because `pty.spawn` is not listed as unsafe in versions below 0.0.33, producing a false-clean security result.

AML.T0107

Delivery via Model Supply Chain

The scan-approved malicious artifact is distributed through a model hub, shared repository, or CI/CD artifact store where downstream users trust the clean scan result.

AML.T0010.001

Code Execution and Host Compromise

Victim loads the model file in a training or inference environment, triggering `pty.spawn` to establish a reverse shell and grant the attacker full control of the ML host.

AML.T0072

Craft Malicious Artifact

Attacker crafts a pickle-based model checkpoint embedding a `pty.spawn` payload that invokes a reverse shell, deliberately using a function absent from PickleScan's unsafe globals list.

AML.T0011.000

Defense Evasion via Scanner Bypass

The malicious file passes PickleScan validation cleanly because `pty.spawn` is not listed as unsafe in versions below 0.0.33, producing a false-clean security result.

AML.T0107

Delivery via Model Supply Chain

The scan-approved malicious artifact is distributed through a model hub, shared repository, or CI/CD artifact store where downstream users trust the clean scan result.

AML.T0010.001

Code Execution and Host Compromise

Victim loads the model file in a training or inference environment, triggering `pty.spawn` to establish a reverse shell and grant the attacker full control of the ML host.

AML.T0072

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
419 3 dependents Pushed 9d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

5 steps

Upgrade PickleScan to version 0.0.33 or later immediately — this release adds pty.spawn to the unsafe globals list.
Re-scan all model files previously approved by PickleScan < 0.0.33 before loading them in any environment.
As defense-in-depth, run model deserialization inside isolated sandboxes (gVisor, Firecracker, or ephemeral containers) regardless of scan results.
Evaluate fickling (Trail of Bits) as a secondary validator — it performs AST-level analysis independent of a fixed unsafe globals list.
For detection: search model files for pty string references as a lightweight pre-check; review PickleScan audit logs for any files scanned with versions below 0.0.33 that were subsequently loaded.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model Framework AML.T0010.001 - AI Software AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0072 - Reverse Shell AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain AI risk management

OWASP LLM Top 10

LLM03:2025 - Supply Chain

Frequently Asked Questions

What is CVE-2025-71322?

PickleScan, the de-facto tool for detecting malicious pickle payloads in ML model files, fails to flag Python's `pty.spawn` function as dangerous, allowing adversaries to craft model checkpoints that pass security scanning while still executing arbitrary code when loaded. This is an especially corrosive vulnerability class: it targets the security control itself, meaning every team relying on PickleScan to gate model loading is operating with a false sense of safety. Attack complexity is low and the impact is full C/I/A compromise (CVSS 8.8), though user interaction is required and no public exploit is currently reported. Upgrade to PickleScan ≥ 0.0.33 immediately and re-scan any model files previously cleared by older versions before loading them.

Is CVE-2025-71322 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71322, increasing the risk of exploitation.

How to fix CVE-2025-71322?

1. Upgrade PickleScan to version 0.0.33 or later immediately — this release adds `pty.spawn` to the unsafe globals list. 2. Re-scan all model files previously approved by PickleScan < 0.0.33 before loading them in any environment. 3. As defense-in-depth, run model deserialization inside isolated sandboxes (gVisor, Firecracker, or ephemeral containers) regardless of scan results. 4. Evaluate `fickling` (Trail of Bits) as a secondary validator — it performs AST-level analysis independent of a fixed unsafe globals list. 5. For detection: search model files for `pty` string references as a lightweight pre-check; review PickleScan audit logs for any files scanned with versions below 0.0.33 that were subsequently loaded.

What systems are affected by CVE-2025-71322?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, MLOps pipelines, model registries, CI/CD security gates.

What is the CVSS score for CVE-2025-71322?

CVE-2025-71322 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.38%.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel servingMLOps pipelinesmodel registriesCI/CD security gates

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0072 Reverse Shell

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. Malicious actors can craft pickle payloads using pty.spawn to achieve arbitrary code execution when files are processed by PickleScan.

Exploitation Scenario

An adversary targeting an ML team's infrastructure crafts a malicious PyTorch `.pt` checkpoint that calls `pty.spawn` to open a reverse shell. The file is submitted to a shared model repository — a pull request adding a fine-tuned checkpoint, a model hub upload, or a poisoned artifact in a CI/CD store. An MLOps engineer runs PickleScan (< 0.0.33) as part of their standard validation workflow; the scan returns clean because `pty.spawn` is not in the unsafe globals list. The engineer loads the checkpoint in a training or inference environment, triggering immediate code execution. The attacker gains shell access to the ML host, with access to model weights, training data, API tokens, and a foothold for lateral movement into cloud infrastructure.

Weaknesses (CWE)

CWE-693 Protection Mechanism Failure Primary CWE-693 Protection Mechanism Failure

CWE-693 — Protection Mechanism Failure: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Source: MITRE CWE corpus.