CVE-2025-71352: picklescan RCE bypass

CISO Take

picklescan is the scanner many ML teams rely on to vet pickle-serialized model files before loading them, and this flaw means it fails to flag Python's built-in trace.Trace.runctx when embedded in a pickle's reduce method — so a malicious model file sails through the scan clean and executes arbitrary code the moment someone calls pickle.load() on it. This matters because picklescan is often the only gate between a model pulled from a public hub and a production or research environment, and a bypass here gives false confidence exactly where teams have outsourced their trust judgment to the tool itself. The CVSS is high (8.1, network vector, no privileges required) but practical urgency is tempered — EPSS sits at just 0.64% (top 54th percentile), there is no public exploit or Nuclei template, and it is not in CISA KEV, so this looks like a disclosed logic gap rather than something being actively weaponized. Upgrade picklescan to 0.0.29 or later immediately, and stop treating any single pickle scanner as sufficient on its own — pair it with a shift to safetensors for new models and sandboxed/isolated loading for anything sourced from an untrusted registry.

Sources: NVD GitHub Advisory EPSS ATLAS vulncheck.com

What is the risk?

High technical severity (CVSS 8.1, C:H/I:H) because a successful bypass yields full arbitrary code execution with no privileges required, but real-world exploitation likelihood is currently low: EPSS is 0.64% (top 54th percentile), there is no known public exploit or scanner template, and it is not in CISA KEV or SSVC-flagged. Requires user interaction (a victim or automated pipeline must load the crafted pickle), which narrows the practical attack surface to model supply-chain ingestion points rather than remote unauthenticated compromise. The risk is concentrated in organizations that treat picklescan output as a definitive safety verdict rather than one layer of defense — for them, this is a silent false negative in a security control, which is a materially different (and often underestimated) risk profile than a typical application vulnerability.

How does the attack unfold?

Craft and stage malicious model

Attacker builds a pickle file whose reduce method invokes trace.Trace.runctx with a malicious payload and publishes it to a public model repository or sends it to a target.

AML.T0058

Evade scanning control

picklescan's pre-load scan fails to recognize trace.Trace.runctx as dangerous and reports the file as safe.

AML.T0011.000

Trigger execution

Victim's pipeline or user calls pickle.load() (directly or via a model-loading wrapper) on the file, invoking the embedded payload.

AML.T0018.002

Code execution impact

Arbitrary code runs with the privileges of the loading process, enabling data theft, credential access, or lateral movement into ML infrastructure.

AML.T0050

Craft and stage malicious model

Attacker builds a pickle file whose reduce method invokes trace.Trace.runctx with a malicious payload and publishes it to a public model repository or sends it to a target.

AML.T0058

Evade scanning control

picklescan's pre-load scan fails to recognize trace.Trace.runctx as dangerous and reports the file as safe.

AML.T0011.000

Trigger execution

Victim's pipeline or user calls pickle.load() (directly or via a model-loading wrapper) on the file, invoking the embedded payload.

AML.T0018.002

Code execution impact

Arbitrary code runs with the privileges of the loading process, enabling data theft, credential access, or lateral movement into ML infrastructure.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
418 3 dependents Pushed 25d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 48% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade picklescan to >=0.0.29 immediately across all environments that scan pickle files pre-load. As defense-in-depth, migrate model storage/exchange to safetensors (which has no code-execution surface) wherever the model architecture supports it. For pickle files that must remain in use, load them only inside a sandboxed/ephemeral environment (restricted container, no network egress, minimal filesystem access) regardless of scan result. Add detection for anomalous trace module usage or unexpected reduce-method targets in ingested pickle files, and audit any models loaded via picklescan-gated pipelines between the tool's prior versions and the patched release for signs of successful bypass.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model AML.T0010.001 - AI Software AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0058 - Publish Poisoned Models

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2 - Third-party and supplier relationships for AI system components

NIST AI RMF

MANAGE 4.1 - Third-party risks and benefits are regularly monitored

OWASP LLM Top 10

LLM05:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71352?

picklescan is the scanner many ML teams rely on to vet pickle-serialized model files before loading them, and this flaw means it fails to flag Python's built-in trace.Trace.runctx when embedded in a pickle's reduce method — so a malicious model file sails through the scan clean and executes arbitrary code the moment someone calls pickle.load() on it. This matters because picklescan is often the only gate between a model pulled from a public hub and a production or research environment, and a bypass here gives false confidence exactly where teams have outsourced their trust judgment to the tool itself. The CVSS is high (8.1, network vector, no privileges required) but practical urgency is tempered — EPSS sits at just 0.64% (top 54th percentile), there is no public exploit or Nuclei template, and it is not in CISA KEV, so this looks like a disclosed logic gap rather than something being actively weaponized. Upgrade picklescan to 0.0.29 or later immediately, and stop treating any single pickle scanner as sufficient on its own — pair it with a shift to safetensors for new models and sandboxed/isolated loading for anything sourced from an untrusted registry.

Is CVE-2025-71352 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71352, increasing the risk of exploitation.

How to fix CVE-2025-71352?

Upgrade picklescan to >=0.0.29 immediately across all environments that scan pickle files pre-load. As defense-in-depth, migrate model storage/exchange to safetensors (which has no code-execution surface) wherever the model architecture supports it. For pickle files that must remain in use, load them only inside a sandboxed/ephemeral environment (restricted container, no network egress, minimal filesystem access) regardless of scan result. Add detection for anomalous trace module usage or unexpected reduce-method targets in ingested pickle files, and audit any models loaded via picklescan-gated pipelines between the tool's prior versions and the patched release for signs of successful bypass.

What systems are affected by CVE-2025-71352?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, MLOps pipelines, AI supply chain / model registries.

What is the CVSS score for CVE-2025-71352?

CVE-2025-71352 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.64%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesMLOps pipelinesAI supply chain / model registries

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0058 Publish Poisoned Models

Compliance Controls Affected

ISO 42001: A.6.2

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

picklescan before 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used in pickle file reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with trace.Trace.runctx payloads that bypass picklescan detection and execute code upon pickle.load() invocation.

Exploitation Scenario

An attacker crafts a malicious pickle-serialized model and embeds a __reduce__ method pointing to trace.Trace.runctx configured to execute an arbitrary command, then uploads the file to a public model repository or sends it directly to a target as a 'pretrained model' or fine-tuning checkpoint. The victim's MLOps pipeline runs picklescan as a pre-load safety check; because trace.Trace.runctx isn't in picklescan's dangerous-function list, the scan reports the file clean. The pipeline proceeds to call pickle.load() (directly or via a wrapper like torch.load with pickle backend) on the file, triggering the attacker's payload and granting code execution with the loading process's privileges — potentially enabling data exfiltration, credential theft, or lateral movement into training/inference infrastructure.

Weaknesses (CWE)

CWE-693 Protection Mechanism Failure Primary CWE-693 Protection Mechanism Failure

CWE-693 — Protection Mechanism Failure: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Source: MITRE CWE corpus.