CVE-2025-71343: picklescan scanner bypass lets

CISO Take

picklescan is the de facto scanning tool many ML teams and model hubs rely on to vet pickle-based model files before deserializing them, and this flaw lets a specially crafted pickle file abuse an internal lib2to3 parser function to slip malicious opcodes past that scan undetected. That matters because picklescan's entire value proposition is catching exactly this kind of payload before pickle.load() executes it — a bypass here means any pipeline that treats a 'clean' scan result as a green light is exposed to arbitrary code execution with no privileges required, contingent only on a user or automated job loading the file. There is no CISA KEV listing, no public exploit code, and EPSS sits at just 0.003 (though that still places it in the top 78th percentile for predicted exploitation), so this looks like a disclosed weakness rather than an active campaign — but the CVSS 8.1 score reflects how much damage a successful bypass causes once triggered. Any team using picklescan below 0.0.30 as a gate for third-party or Hugging-Face-sourced models should upgrade immediately and, longer term, stop treating scanner clearance as sufficient on its own.

Sources: NVD GitHub Advisory EPSS ATLAS vulncheck.com

What is the risk?

High severity (CVSS 8.1) driven by full confidentiality and integrity loss on successful exploitation, but real-world risk is currently moderate: exploitation requires an attacker to craft a working lib2to3-based bypass and get a victim or automated pipeline to run pickle.load() on the resulting file (UI:R). No CISA KEV entry, no public exploit, and no Nuclei template exist yet, and EPSS (0.003) is low in absolute terms despite the 78th-percentile ranking. The systemic risk is larger than the raw score suggests: any organization using picklescan as its sole control against malicious pickle-based model files has effectively zero protection against this specific bypass class until patched.

How does the attack unfold?

Malicious Artifact Publication

Attacker crafts a pickle-based model file whose __reduce__ payload abuses lib2to3.pgen2.pgen.ParserGenerator.make_label to structure opcodes that evade picklescan's detection logic.

AML.T0058

Trust Bypass via Scanning

Victim's MLOps pipeline or model hub scans the artifact with picklescan, which returns a clean result because the crafted payload isn't recognized as malicious.

AML.T0010.003

User Execution

A user or automated job loads the file with pickle.load(), triggering execution of the embedded arbitrary code.

AML.T0011.000

Impact — Code Execution

Attacker-controlled code executes with the privileges of the loading process, enabling credential theft, lateral movement, or tampering with ML artifacts.

AML.T0050

Malicious Artifact Publication

Attacker crafts a pickle-based model file whose __reduce__ payload abuses lib2to3.pgen2.pgen.ParserGenerator.make_label to structure opcodes that evade picklescan's detection logic.

AML.T0058

Trust Bypass via Scanning

Victim's MLOps pipeline or model hub scans the artifact with picklescan, which returns a clean result because the crafted payload isn't recognized as malicious.

AML.T0010.003

User Execution

A user or automated job loads the file with pickle.load(), triggering execution of the embedded arbitrary code.

AML.T0011.000

Impact — Code Execution

Attacker-controlled code executes with the privileges of the loading process, enabling credential theft, lateral movement, or tampering with ML artifacts.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
418 3 dependents Pushed 25d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Advanced

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade picklescan to >= 0.0.30 immediately in any pipeline or CI job that performs pre-load scanning of pickle files. Until patched, do not treat a 'clean' picklescan result as sufficient assurance — add defense in depth: load untrusted pickle files only inside an isolated/sandboxed environment (container with no network access or credentials, or a restricted subprocess), and prefer safetensors or other non-executable serialization formats for models sourced from third parties. For detection, monitor for pickle.load() calls immediately following model downloads from external sources, and audit models already ingested via picklescan-gated pipelines prior to this patch for anomalous lib2to3/pgen-related opcodes or unexpected REDUCE opcodes referencing uncommon modules.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model Framework AML.T0010.003 - Model AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0058 - Publish Poisoned Models

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.8.3 - AI system design and development / secure lifecycle controls

NIST AI RMF

MEASURE 2.7 - AI system security is evaluated and regularly assessed for cybersecurity risk

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71343?

picklescan is the de facto scanning tool many ML teams and model hubs rely on to vet pickle-based model files before deserializing them, and this flaw lets a specially crafted pickle file abuse an internal lib2to3 parser function to slip malicious opcodes past that scan undetected. That matters because picklescan's entire value proposition is catching exactly this kind of payload before pickle.load() executes it — a bypass here means any pipeline that treats a 'clean' scan result as a green light is exposed to arbitrary code execution with no privileges required, contingent only on a user or automated job loading the file. There is no CISA KEV listing, no public exploit code, and EPSS sits at just 0.003 (though that still places it in the top 78th percentile for predicted exploitation), so this looks like a disclosed weakness rather than an active campaign — but the CVSS 8.1 score reflects how much damage a successful bypass causes once triggered. Any team using picklescan below 0.0.30 as a gate for third-party or Hugging-Face-sourced models should upgrade immediately and, longer term, stop treating scanner clearance as sufficient on its own.

Is CVE-2025-71343 actively exploited?

No confirmed active exploitation of CVE-2025-71343 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-71343?

Upgrade picklescan to >= 0.0.30 immediately in any pipeline or CI job that performs pre-load scanning of pickle files. Until patched, do not treat a 'clean' picklescan result as sufficient assurance — add defense in depth: load untrusted pickle files only inside an isolated/sandboxed environment (container with no network access or credentials, or a restricted subprocess), and prefer safetensors or other non-executable serialization formats for models sourced from third parties. For detection, monitor for pickle.load() calls immediately following model downloads from external sources, and audit models already ingested via picklescan-gated pipelines prior to this patch for anomalous lib2to3/pgen-related opcodes or unexpected REDUCE opcodes referencing uncommon modules.

What systems are affected by CVE-2025-71343?

This vulnerability affects the following AI/ML architecture patterns: model serving, MLOps pipelines, model registries/hubs, training pipelines.

What is the CVSS score for CVE-2025-71343?

CVE-2025-71343 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

model servingMLOps pipelinesmodel registries/hubstraining pipelines

MITRE ATLAS Techniques

AML.T0010.003 Model

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0058 Publish Poisoned Models

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.8.3

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.make_label function in the reduce method. Attackers can craft malicious pickle files with embedded code that evades detection but executes arbitrary commands when pickle.load() is called.

Exploitation Scenario

An attacker publishes a trojanized model checkpoint to a public model hub or supply-chain-adjacent repository, embedding a malicious __reduce__ payload that abuses lib2to3.pgen2.pgen.ParserGenerator.make_label to structure the pickle opcodes in a way picklescan's pattern matching doesn't flag as dangerous. A victim's MLOps pipeline (or an individual data scientist) downloads the model, runs it through picklescan as a standard security gate, and — because the scan reports no issues — proceeds to load it with pickle.load(). At that moment the embedded code executes with the privileges of the loading process, giving the attacker a foothold to exfiltrate credentials, pivot within the ML infrastructure, or tamper with downstream training/inference artifacts.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.