AI Threat Alert
CVE-2025-71342: picklescan: idlelib bypass hides pickle RCE
HIGH CISA: ATTENDpicklescan, the scanner many teams rely on to flag malicious pickle files before they're loaded into PyTorch pipelines, fails to detect payloads that abuse idlelib.run.Executive.runcode inside a __reduce__ method — the poisoned file scans clean and then executes arbitrary code the moment pickle.load() runs. This matters because picklescan is often the sole safety gate before pulling third-party checkpoints from model hubs or internal registries, so this bypass quietly defeats a control organizations already trust to catch supply-chain tampering in AI artifacts. EPSS is low (0.43%, ~66th percentile) and there's no public exploit, nuclei template, or CISA KEV listing, so this isn't under active mass exploitation, but the bypass technique is now documented in a public advisory and VulnCheck writeup, shortening the runway before it's weaponized. Any pipeline that treats a passing picklescan result as sufficient assurance for an untrusted pickle-based model is exposed today. Patch to picklescan >=0.0.30 immediately, and stop treating any scanner as a substitute for migrating untrusted model sources to safetensors, which has no code-execution surface at all.
What is the risk?
High severity (CVSS 8.1) driven by network attack vector and no privileges required, tempered by mandatory user interaction (a victim or pipeline must actually load the crafted pickle) and no availability impact per the vector (A:N). The real risk multiplier isn't the RCE primitive itself — pickle deserialization RCE is well known — it's that this specific flaw breaks the detection control organizations deployed specifically to catch that primitive. Low EPSS and absence from CISA KEV indicate no current mass exploitation, but the vulnerability class (scanner logic gaps for known-dangerous reduce-method payloads) is exactly the kind of technique likely to get incorporated into red-team and malware tooling once public.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| picklescan | pip | — | No patch |
Do you use picklescan? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
1) Upgrade picklescan to >=0.0.30 immediately across all CI/CD and registry integrations. 2) Do not treat a clean picklescan result as sufficient for untrusted models — migrate model storage/exchange to safetensors, which has no arbitrary-code execution surface. 3) Add detection rules for idlelib.run.Executive.runcode (and other idlelib.run references) appearing in any scanned pickle stream as a direct IOC. 4) Where pickle must still be used, load models in a sandboxed/isolated process with no network or credential access. 5) Re-scan previously 'cleared' pickle artifacts in registries with the patched scanner version to catch anything that slipped through before the fix.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2025-71342?
picklescan, the scanner many teams rely on to flag malicious pickle files before they're loaded into PyTorch pipelines, fails to detect payloads that abuse idlelib.run.Executive.runcode inside a __reduce__ method — the poisoned file scans clean and then executes arbitrary code the moment pickle.load() runs. This matters because picklescan is often the sole safety gate before pulling third-party checkpoints from model hubs or internal registries, so this bypass quietly defeats a control organizations already trust to catch supply-chain tampering in AI artifacts. EPSS is low (0.43%, ~66th percentile) and there's no public exploit, nuclei template, or CISA KEV listing, so this isn't under active mass exploitation, but the bypass technique is now documented in a public advisory and VulnCheck writeup, shortening the runway before it's weaponized. Any pipeline that treats a passing picklescan result as sufficient assurance for an untrusted pickle-based model is exposed today. Patch to picklescan >=0.0.30 immediately, and stop treating any scanner as a substitute for migrating untrusted model sources to safetensors, which has no code-execution surface at all.
Is CVE-2025-71342 actively exploited?
No confirmed active exploitation of CVE-2025-71342 has been reported, but organizations should still patch proactively.
How to fix CVE-2025-71342?
1) Upgrade picklescan to >=0.0.30 immediately across all CI/CD and registry integrations. 2) Do not treat a clean picklescan result as sufficient for untrusted models — migrate model storage/exchange to safetensors, which has no arbitrary-code execution surface. 3) Add detection rules for idlelib.run.Executive.runcode (and other idlelib.run references) appearing in any scanned pickle stream as a direct IOC. 4) Where pickle must still be used, load models in a sandboxed/isolated process with no network or credential access. 5) Re-scan previously 'cleared' pickle artifacts in registries with the patched scanner version to catch anything that slipped through before the fix.
What systems are affected by CVE-2025-71342?
This vulnerability affects the following AI/ML architecture patterns: model serving, MLOps pipelines / CI/CD security gating, model registries and hubs, training pipelines.
What is the CVSS score for CVE-2025-71342?
CVE-2025-71342 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.43%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.001 AI Software AML.T0011.000 Unsafe AI Artifacts AML.T0018.002 Embed Malware AML.T0050 Command and Scripting Interpreter Compliance Controls Affected
What are the technical details?
Original Advisory
picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in pickle files that executes during pickle.load, enabling remote code execution in PyTorch models and supply chain attacks.
Exploitation Scenario
An adversary crafts a PyTorch checkpoint whose pickle stream includes a __reduce__ method referencing idlelib.run.Executive.runcode with an embedded malicious code string, then publishes it to a public model hub or sends it to a target team disguised as a fine-tuned model update. The victim's MLOps pipeline runs picklescan (pre-0.0.30) as a pre-deployment safety check; the scanner's detection rules don't recognize the idlelib.run.Executive.runcode call chain as dangerous, so the artifact passes and is promoted to the model registry. A data scientist or inference service then loads the checkpoint via torch.load/pickle.load, triggering runcode and handing the attacker code execution with the loading process's privileges — enabling credential theft, lateral movement, or further model/data poisoning inside the ML environment.
Weaknesses (CWE)
CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
- [Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
- [Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N References
Timeline
Related Vulnerabilities
CVE-2026-3490 10.0 picklescan: blocklist bypass enables full RCE
Same package: picklescan GHSA-vvpj-8cmc-gx39 10.0 picklescan: security flaw enables exploitation
Same package: picklescan GHSA-g38g-8gr9-h9xp 9.8 picklescan: Allowlist Bypass evades input filtering
Same package: picklescan CVE-2025-1945 9.8 picklescan: ZIP flag bypass enables RCE in PyTorch models
Same package: picklescan GHSA-7wx9-6375-f5wh 9.8 picklescan: Allowlist Bypass evades input filtering
Same package: picklescan