CVE-2025-71349: picklescan: bypass allows undetected pickle RCE

picklescan versions before 0.0.29 fail to flag Python's built-in trace.Trace.run as a dangerous callable when scanning pickle files, so a maliciously crafted pickle using this function in its __reduce__ method sails through the scanner as "safe" and executes arbitrary code the moment pickle.load() processes it. This matters because picklescan is a widely-used safety gate for model registries and ML pipelines that ingest untrusted pickle-serialized artifacts (models, checkpoints, datasets), so a bypass here quietly defeats the exact control teams rely on to prevent supply-chain RCE from third-party models. Exploitation likelihood is currently low — EPSS sits at 0.56% (top 57th percentile), there's no public exploit or Nuclei template, and it's not in CISA KEV or SSVC-flagged — but the attack requires only user interaction (someone loading the file) with no privileges and low complexity, so it remains a credible risk anywhere pickle files from external or semi-trusted sources are scanned before use. Upgrade picklescan to 0.0.29 or later immediately; until patched, treat picklescan as a defense-in-depth layer rather than a sole gate, and prefer safetensors or explicit allowlisting of safe globals over pickle deserialization wherever feasible.

Proof-of-concept exploit code is publicly available for CVE-2025-71349, increasing the risk of exploitation.

Upgrade picklescan to version 0.0.29 or later immediately in any pipeline that uses it as a pickle-safety gate. Until upgraded, do not treat a clean picklescan result as sufficient — combine it with format migration to safetensors (which avoids arbitrary deserialization entirely) or restrict pickle loading to fully trusted, internally-generated artifacts only. Where pickle files from external sources must be accepted, run detonation in an isolated sandbox and monitor for unexpected child processes or network calls triggered during deserialization. Audit CI/CD and model-registry integrations for hardcoded trust in picklescan's verdict and add a secondary control (e.g., restricted unpickler with explicit safe-class allowlist) as defense-in-depth.

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, MLOps/model registries, supply chain / artifact ingestion.

CVE-2025-71349 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.56%.