CVE-2025-71356: picklescan torch.fx gadget bypasses

CISO Take

picklescan, the open-source scanner many ML pipelines rely on to vet pickle-serialized model files before loading them, fails to flag pickle files that call torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression — a legitimate PyTorch internal that evaluates attacker-controlled strings and can be weaponized for arbitrary code execution. This matters less because of raw severity (CVSS 8.1, network vector, no privileges) and more because it defeats the exact control teams put in place specifically to catch this class of attack: a 'scanned and clean' pickle file can still detonate the moment someone calls torch.load() on it. EPSS sits low (top 78th percentile, not top-tier), it's not in CISA KEV, and no public exploit or Nuclei template exists yet, so this isn't an active-exploitation emergency — but any model registry, CI ingestion gate, or internal Hugging Face-style mirror that treats a picklescan pass as a trust boundary is currently giving a false sense of safety. Upgrade picklescan to 0.0.28 or later immediately, and re-scan any pickle-format model artifacts accepted between their upload and the patch date. Longer term, stop trusting scanner output as a sufficient control for untrusted pickle files — prefer safetensors for any externally-sourced model weights.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

High-severity but not high-urgency: the flaw is a detection gap in a security tool (picklescan) rather than a directly network-reachable service vulnerability, so exploitation requires an attacker to get a crafted pickle file in front of a victim and for the victim (or an automated pipeline) to load it with torch — hence CVSS's User Interaction:Required. Once triggered, impact is severe: full confidentiality and integrity compromise (arbitrary code execution) with no built-in constraint on what the payload can do. Low EPSS (0.003) and absence from CISA KEV indicate no observed mass exploitation yet, but the bug undermines a purpose-built safety control, so organizations that gate model ingestion on picklescan results have a false sense of security regardless of EPSS.

How does the attack unfold?

Craft malicious artifact

Attacker embeds a call to torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression with an attacker-controlled expression inside a pickle-serialized model file.

AML.T0011.000

Evade detection

The file is submitted to a picklescan (<0.0.28) scan gate and passes as clean because this specific gadget is not in its blocklist.

AML.T0018.002

Victim loads artifact

A data scientist or automated pipeline loads the 'verified' pickle file with torch.load(), invoking the embedded function.

AML.T0011

Code execution

evaluate_guards_expression evaluates the attacker's payload, granting arbitrary code execution inside the victim's ML environment.

AML.T0050

Craft malicious artifact

Attacker embeds a call to torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression with an attacker-controlled expression inside a pickle-serialized model file.

AML.T0011.000

Evade detection

The file is submitted to a picklescan (<0.0.28) scan gate and passes as clean because this specific gadget is not in its blocklist.

AML.T0018.002

Victim loads artifact

A data scientist or automated pipeline loads the 'verified' pickle file with torch.load(), invoking the embedded function.

AML.T0011

Code execution

evaluate_guards_expression evaluates the attacker's payload, granting arbitrary code execution inside the victim's ML environment.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
picklescan	pip	—	No patch
418 3 dependents Pushed 25d ago 53% patched ~12d to patch Full package profile →

Do you use picklescan? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A None

What should I do?

1 step

Upgrade picklescan to >= 0.0.28 immediately across all CI, registry-ingestion, and developer tooling that depends on it. Treat any pickle file that was scanned and approved by an older picklescan version between its introduction and the patch as unverified — re-scan or manually review high-value artifacts accepted in that window. Do not rely on picklescan (or any single static scanner) as the sole control for untrusted pickle files; add sandboxed/isolated loading (containerized, no network, restricted filesystem) for any pickle-format model of unknown provenance. Where possible, migrate model storage/exchange to safetensors, which has no code-execution surface by design and eliminates this entire class of risk. Monitor for anomalous process spawning or outbound connections immediately following torch.load() calls in CI runners and notebook environments as a detection signal.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model AML.T0010.001 - AI Software AML.T0011 - User Execution AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system supply chain security

NIST AI RMF

MAP-3.4 - Third-party AI resource risks are identified and documented

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-71356?

picklescan, the open-source scanner many ML pipelines rely on to vet pickle-serialized model files before loading them, fails to flag pickle files that call torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression — a legitimate PyTorch internal that evaluates attacker-controlled strings and can be weaponized for arbitrary code execution. This matters less because of raw severity (CVSS 8.1, network vector, no privileges) and more because it defeats the exact control teams put in place specifically to catch this class of attack: a 'scanned and clean' pickle file can still detonate the moment someone calls torch.load() on it. EPSS sits low (top 78th percentile, not top-tier), it's not in CISA KEV, and no public exploit or Nuclei template exists yet, so this isn't an active-exploitation emergency — but any model registry, CI ingestion gate, or internal Hugging Face-style mirror that treats a picklescan pass as a trust boundary is currently giving a false sense of safety. Upgrade picklescan to 0.0.28 or later immediately, and re-scan any pickle-format model artifacts accepted between their upload and the patch date. Longer term, stop trusting scanner output as a sufficient control for untrusted pickle files — prefer safetensors for any externally-sourced model weights.

Is CVE-2025-71356 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71356, increasing the risk of exploitation.

How to fix CVE-2025-71356?

Upgrade picklescan to >= 0.0.28 immediately across all CI, registry-ingestion, and developer tooling that depends on it. Treat any pickle file that was scanned and approved by an older picklescan version between its introduction and the patch as unverified — re-scan or manually review high-value artifacts accepted in that window. Do not rely on picklescan (or any single static scanner) as the sole control for untrusted pickle files; add sandboxed/isolated loading (containerized, no network, restricted filesystem) for any pickle-format model of unknown provenance. Where possible, migrate model storage/exchange to safetensors, which has no code-execution surface by design and eliminates this entire class of risk. Monitor for anomalous process spawning or outbound connections immediately following torch.load() calls in CI runners and notebook environments as a detection signal.

What systems are affected by CVE-2025-71356?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, MLOps / model registries.

What is the CVSS score for CVE-2025-71356?

CVE-2025-71356 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesMLOps / model registries

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011 User Execution

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MAP-3.4

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function calls in pickle files. Attackers can embed undetected code in pickle files that executes remote code when loaded by victims.

Exploitation Scenario

An attacker uploads a poisoned model checkpoint (e.g., a 'fine-tuned' variant of a popular open model) to a public model-sharing site or sends it directly to a target ML team. The pickle file embeds a call to torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression with an attacker-controlled expression string. The victim's ingestion pipeline runs picklescan (pre-0.0.28) as a safety gate; the scan reports the file clean because this specific gadget isn't in its detection rules. The file is promoted to a trusted registry or handed to a data scientist, who loads it with torch.load() in their training or inference environment — evaluate_guards_expression evaluates the attacker's payload, achieving arbitrary code execution inside the ML environment, with potential access to training data, credentials, or lateral movement into the broader MLOps infrastructure.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.