CVE-2025-71340: picklescan scanner bypass enables RCE

CISO Take

picklescan versions through 0.0.26 fail to detect malicious pickle files that exploit the `idlelib.pyshell.ModifiedInterpreter.runcode` call path in `__reduce__` methods, allowing arbitrary code execution when a model file is loaded via `pickle.load()`. This matters because picklescan is deployed specifically as a supply chain defense for ML model pipelines — its failure creates a false sense of security for organizations that scan PyTorch models or other serialized Python objects before loading them. The bypass technique is publicly documented in GHSA-3gf5-cxq9-w223, which lowers the skill bar significantly for attackers targeting automated model ingestion pipelines that trust picklescan scan results. Upgrade picklescan to 0.0.30 immediately and treat any models previously cleared by versions ≤0.0.26 as untrusted until re-scanned.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High risk for any organization using picklescan as a security gate in ML model loading workflows. The core danger is not just a vulnerability but the undermining of a dedicated security control — pipelines that depend on picklescan now have a systematic blind spot. Attack complexity is low once the bypass is known (fully public via GHSA), no privileges are required, and while user interaction is technically required, in automated MLOps pipelines the `pickle.load()` call is often implicit and unsupervised. No EPSS data is available and the CVE is not in CISA KEV, but the public advisory dramatically reduces attacker skill requirements. Blast radius is highest in organizations running automated model ingestion from external or semi-trusted sources.

How does the attack unfold?

Craft Evasive Payload

Attacker creates a pickle file with idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ that executes arbitrary commands while evading picklescan ≤0.0.26 detection.

AML.T0018.002

Supply Chain Injection

Attacker distributes the malicious model file via a public model hub, compromised registry, or third-party dependency targeting organizations that rely on picklescan as their validation gate.

AML.T0010.001

Scanner Evasion

The target's automated pipeline runs picklescan on the file; the tool reports no threats and the model is marked safe, creating a false-negative that advances the file to production.

AML.T0074

Arbitrary Code Execution

The cleared model file is loaded via pickle.load() in the ML serving or training environment, triggering the malicious __reduce__ payload with full process privileges.

AML.T0011.000

Craft Evasive Payload

Attacker creates a pickle file with idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ that executes arbitrary commands while evading picklescan ≤0.0.26 detection.

AML.T0018.002

Supply Chain Injection

Attacker distributes the malicious model file via a public model hub, compromised registry, or third-party dependency targeting organizations that rely on picklescan as their validation gate.

AML.T0010.001

Scanner Evasion

The target's automated pipeline runs picklescan on the file; the tool reports no threats and the model is marked safe, creating a false-negative that advances the file to production.

AML.T0074

Arbitrary Code Execution

The cleared model file is loaded via pickle.load() in the ML serving or training environment, triggering the malicious __reduce__ payload with full process privileges.

AML.T0011.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
418 3 dependents Pushed 17d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

6 steps

Upgrade picklescan to version 0.0.30 immediately — this is the only complete fix.
Re-scan all model files previously validated by picklescan ≤0.0.26; treat them as untrusted until re-validated.
Adopt defense-in-depth: complement picklescan with fickling for secondary validation, or preferentially migrate PyTorch model serialization to SafeTensors format, which eliminates pickle deserialization entirely.
Apply least privilege to processes that load model files — restrict filesystem access, outbound network, and credential scope of ML serving processes.
Add EDR/XDR behavioral rules for unexpected child processes or shell invocations spawned from Python pickle.load() operations.
Pin picklescan ≥0.0.30 in CI/CD pipelines and enforce version checks as a pipeline gate.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model Framework AML.T0010.001 - AI Software AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0074 - Masquerading AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

A.6.2 - AI system supply chain risk management

NIST AI RMF

GOVERN 6.1 - Policies and procedures for AI supply chain risk management

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71340?

picklescan versions through 0.0.26 fail to detect malicious pickle files that exploit the `idlelib.pyshell.ModifiedInterpreter.runcode` call path in `__reduce__` methods, allowing arbitrary code execution when a model file is loaded via `pickle.load()`. This matters because picklescan is deployed specifically as a supply chain defense for ML model pipelines — its failure creates a false sense of security for organizations that scan PyTorch models or other serialized Python objects before loading them. The bypass technique is publicly documented in GHSA-3gf5-cxq9-w223, which lowers the skill bar significantly for attackers targeting automated model ingestion pipelines that trust picklescan scan results. Upgrade picklescan to 0.0.30 immediately and treat any models previously cleared by versions ≤0.0.26 as untrusted until re-scanned.

Is CVE-2025-71340 actively exploited?

No confirmed active exploitation of CVE-2025-71340 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-71340?

1. Upgrade picklescan to version 0.0.30 immediately — this is the only complete fix. 2. Re-scan all model files previously validated by picklescan ≤0.0.26; treat them as untrusted until re-validated. 3. Adopt defense-in-depth: complement picklescan with `fickling` for secondary validation, or preferentially migrate PyTorch model serialization to SafeTensors format, which eliminates pickle deserialization entirely. 4. Apply least privilege to processes that load model files — restrict filesystem access, outbound network, and credential scope of ML serving processes. 5. Add EDR/XDR behavioral rules for unexpected child processes or shell invocations spawned from Python `pickle.load()` operations. 6. Pin picklescan ≥0.0.30 in CI/CD pipelines and enforce version checks as a pipeline gate.

What systems are affected by CVE-2025-71340?

This vulnerability affects the following AI/ML architecture patterns: ML model training pipelines, Model serving infrastructure, MLOps CI/CD pipelines, Model registries and repositories, AI/ML development environments.

What is the CVSS score for CVE-2025-71340?

CVE-2025-71340 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

ML model training pipelinesModel serving infrastructureMLOps CI/CD pipelinesModel registries and repositoriesAI/ML development environments

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0074 Masquerading

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects. This is fixed in version 0.0.30.

Exploitation Scenario

An attacker targeting an organization's ML inference pipeline crafts a PyTorch checkpoint containing a malicious `__reduce__` method that calls `idlelib.pyshell.ModifiedInterpreter.runcode` with a reverse shell payload. The file is uploaded to a public model hub or injected into a compromised internal registry. The organization's automated model ingestion pipeline runs picklescan ≤0.0.26 on the file — it reports no threats and the model is promoted to the serving tier. During inference service startup, `pickle.load()` deserializes the checkpoint, triggering the embedded payload with the privileges of the serving process. The attacker gains shell access to the inference host, from which they pivot to exfiltrate API keys, training data, and cloud credentials stored in the environment.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.