CVE-2025-71345: picklescan scanner blocklist bypass

CISO Take

picklescan is the de-facto scanning tool many ML pipelines and model hubs use to vet pickle-serialized model files before they're trusted or deployed, and versions before 0.0.30 fail to flag payloads that invoke torch.utils.bottleneck.__main__.run_autograd_prof, letting a malicious pickle sail through the scan and then execute arbitrary code the moment it's deserialized. This matters because the bypass doesn't just create a vulnerability, it defeats the control organizations rely on to catch the well-known 'malicious pickle' supply chain attack (CWE-502) — a model that picklescan clears gets treated as trusted and gets promoted into registries, CI pipelines, or production inference services. Exploitation signals are currently quiet (EPSS 0.43%, top 66th percentile; not in CISA KEV; no public exploit or Nuclei template), so this looks like a research-disclosed gap rather than something under active attack, but the low complexity and lack of required privileges mean any org using picklescan as a hard gate should not assume 'scanned' equals 'safe'. Upgrade picklescan to >=0.0.30 immediately, re-scan any artifacts previously cleared by an older version, and treat picklescan as defense-in-depth rather than a sole control — pair it with torch.load(weights_only=True) or migration to safetensors for untrusted sources.

Sources: NVD GitHub Advisory EPSS ATLAS vulncheck.com

What is the risk?

CVSS 8.1 (high) reflects the network-reachable, low-complexity, no-privilege RCE that results once a bypassed pickle is loaded, but real-world risk is concentrated in organizations that use picklescan as an automated trust gate — model hubs, internal registries, or CI/CD ingestion that auto-approve files passing the scan. The requirement for user interaction is a minor barrier in practice since loading a downloaded checkpoint via torch.load is a routine, often automated step in ML workflows. No active exploitation, KEV listing, or public PoC/scanner template exists today, and EPSS sits in the mid-range (top 66th percentile), so this reads as a disclosed detection gap rather than an in-the-wild threat — but it directly undermines a widely-deployed AI supply chain security control, which raises its strategic importance above what the EPSS score alone suggests.

How does the attack unfold?

Craft malicious pickle

Attacker builds a pickle file disguised as a model checkpoint that invokes torch.utils.bottleneck.__main__.run_autograd_prof, a function outside picklescan's dangerous-call blocklist.

AML.T0018.002

Evade scanner

The file is submitted to a model hub or CI/CD ingestion pipeline where picklescan <0.0.30 scans it and reports no malicious calls, marking it as safe.

AML.T0010.003

Trusted distribution

The falsely-cleared file is published, promoted, or forwarded to downstream users/pipelines as a verified, safe model artifact.

Deserialize and execute

A victim loads the checkpoint via torch.load, triggering the embedded pickle opcode and achieving remote code execution with no privileges required.

AML.T0011.000

Craft malicious pickle

Attacker builds a pickle file disguised as a model checkpoint that invokes torch.utils.bottleneck.__main__.run_autograd_prof, a function outside picklescan's dangerous-call blocklist.

AML.T0018.002

Evade scanner

The file is submitted to a model hub or CI/CD ingestion pipeline where picklescan <0.0.30 scans it and reports no malicious calls, marking it as safe.

AML.T0010.003

Trusted distribution

The falsely-cleared file is published, promoted, or forwarded to downstream users/pipelines as a verified, safe model artifact.

Deserialize and execute

A victim loads the checkpoint via torch.load, triggering the embedded pickle opcode and achieving remote code execution with no privileges required.

AML.T0011.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
418 3 dependents Pushed 25d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade picklescan to >=0.0.30 immediately in any pipeline that uses it as an ingestion or promotion gate. Re-scan (or re-review) any model files that were previously cleared by a vulnerable picklescan version, since a 'passed' result from before the fix cannot be trusted. Where feasible, migrate untrusted or third-party model distribution to safetensors instead of pickle to remove the deserialization attack surface entirely. As defense-in-depth, load untrusted checkpoints with torch.load(weights_only=True) and/or in a sandboxed/unprivileged environment rather than relying on scanning alone. Track the GHSA advisory (GHSA-4whj-rm5r-c2v8) for further blocklist gaps, since picklescan's approach (denylisting known-dangerous functions) is inherently prone to incomplete-coverage bypasses like this one.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model Inference AML.T0010.003 - Model AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - Third-party and supply chain relationships

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM05:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71345?

picklescan is the de-facto scanning tool many ML pipelines and model hubs use to vet pickle-serialized model files before they're trusted or deployed, and versions before 0.0.30 fail to flag payloads that invoke torch.utils.bottleneck.__main__.run_autograd_prof, letting a malicious pickle sail through the scan and then execute arbitrary code the moment it's deserialized. This matters because the bypass doesn't just create a vulnerability, it defeats the control organizations rely on to catch the well-known 'malicious pickle' supply chain attack (CWE-502) — a model that picklescan clears gets treated as trusted and gets promoted into registries, CI pipelines, or production inference services. Exploitation signals are currently quiet (EPSS 0.43%, top 66th percentile; not in CISA KEV; no public exploit or Nuclei template), so this looks like a research-disclosed gap rather than something under active attack, but the low complexity and lack of required privileges mean any org using picklescan as a hard gate should not assume 'scanned' equals 'safe'. Upgrade picklescan to >=0.0.30 immediately, re-scan any artifacts previously cleared by an older version, and treat picklescan as defense-in-depth rather than a sole control — pair it with torch.load(weights_only=True) or migration to safetensors for untrusted sources.

Is CVE-2025-71345 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71345, increasing the risk of exploitation.

How to fix CVE-2025-71345?

Upgrade picklescan to >=0.0.30 immediately in any pipeline that uses it as an ingestion or promotion gate. Re-scan (or re-review) any model files that were previously cleared by a vulnerable picklescan version, since a 'passed' result from before the fix cannot be trusted. Where feasible, migrate untrusted or third-party model distribution to safetensors instead of pickle to remove the deserialization attack surface entirely. As defense-in-depth, load untrusted checkpoints with torch.load(weights_only=True) and/or in a sandboxed/unprivileged environment rather than relying on scanning alone. Track the GHSA advisory (GHSA-4whj-rm5r-c2v8) for further blocklist gaps, since picklescan's approach (denylisting known-dangerous functions) is inherently prone to incomplete-coverage bypasses like this one.

What systems are affected by CVE-2025-71345?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, MLOps CI/CD, model registries/hubs.

What is the CVSS score for CVE-2025-71345?

CVE-2025-71345 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.43%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesMLOps CI/CDmodel registries/hubs

MITRE ATLAS Techniques

AML.T0010.003 Model

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

picklescan before 0.0.30 fails to detect malicious pickle files that invoke torch.utils.bottleneck.__main__.run_autograd_prof function. Attackers can embed undetected code in pickle files that executes during deserialization, enabling remote code execution.

Exploitation Scenario

An attacker crafts a pickle file disguised as a model checkpoint that, instead of calling a commonly-blocklisted dangerous function, invokes torch.utils.bottleneck.__main__.run_autograd_prof to smuggle a REDUCE opcode achieving code execution. The attacker uploads this file to a public model hub or sends it directly to a target organization's model intake pipeline. An automated CI/CD or hub ingestion process scans the file with a vulnerable picklescan version, finds no blocklisted calls, and marks it safe — the file is then promoted, published, or forwarded as a 'verified' artifact. A victim engineer or an automated inference service subsequently loads the checkpoint via torch.load, triggering deserialization of the malicious opcode and achieving remote code execution inside the ML runtime or container, with no further privileges needed.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.